{ "$schema": "./reference-library.schema.json", "schema_version": 2, "generated_at": "2026-09-09", "title": "1200km Article and Guide Reference Library", "description": "Deduplicated external sources cited across maintained 1200km articles, guides, research, case studies, documentation, and labs.", "evidence_boundary": "Tags and usage links are discovery metadata derived from published 1200km pages. Citation does not imply endorsement, current validity, attribution, exploitation, causality, or control effectiveness.", "source_dataset": "/data/content-catalog.json and /data/ai-attack-reference-library.json", "record_count": 1678, "core_count": 103, "context_count": 5, "site_count": 1570, "usage_link_count": 2369, "unique_tag_count": 1971, "tag_assignment_count": 12870, "records": [ { "id": "ai-attack-reference:pub-006", "title": "“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI", "description": "Cisco Talos operational CTI publication covering Malware development, Reconnaissance and target research, and Translation and localization. Indexed with UAT-10147, Cryptocurrency, and Anthropic context.", "url": "https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/", "publisher": "Cisco Talos", "published_at": "2026-08-04", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "54 targets · medium confidence", "key": "metric:54-targets-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "over 1,300 users · medium confidence", "key": "metric:over-1-300-users-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "15 minutes · medium confidence", "key": "metric:15-minutes-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "30 seconds · medium confidence", "key": "metric:30-seconds-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "84500 seconds · medium confidence", "key": "metric:84500-seconds-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "0.0% · medium confidence", "key": "metric:0.0-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "100% · medium confidence", "key": "metric:100-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "ixmax[.]cn", "key": "ioc:ixmax-.-cn" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "tubely[.]com", "key": "ioc:tubely-.-com" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Cisco Talos", "key": "publisher:cisco-talos" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.talosintelligence.com", "key": "publisher-domain:blog.talosintelligence.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Threat group", "type": "threat_group", "value": "UAT-10147", "key": "threat-group:uat-10147" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UAT-10147", "key": "threat-group-identifier:uat-10147" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:nvd.nist.gov:3a180580b024616d", "title": "(CVE-2014–4114)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4114", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cisa.gov:a1b515ecca4cbca9", "title": "(Cybersecurity and Infrastructure Security Agency)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:github.com:a0da02c1746a5238", "title": "(Link to this tool here)", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/anpa1200/Malware_analysis/blob/main/Basic_inf_gathering", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" }, { "title": "SPW AW25 — PO.010 SMS.exe.exe (AgentTesla)", "url": "https://1200km.com/articles/read/2025/2025-03-24-spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:e4f85f0eab60f000", "title": "(Link to this tool)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/Malware_analysis/blob/main/string_analyser.py", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:csrc.nist.gov:fedd870c5f5632b3", "title": "[1]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://csrc.nist.gov/pubs/sp/800/94/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cybersecurity-insiders.com:5464f6d076f8044b", "title": "[1]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cybersecurity-insiders.com/portfolio/insider-threat-report", "publisher": "Cybersecurity Insiders", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cybersecurity-insiders.com", "key": "publisher-domain:cybersecurity-insiders.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cisa.gov:de40c0427ac64f3e", "title": "[11]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/resources-tools/resources/guide-securing-microsoft-windows-10-and-windows-11-audit-and-monitoring-events", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:1e5386b76856c822", "title": "[11]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/archive/usao/nj/Press/files/pdffiles/Older/duro1213rel.pdf", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cyber.gov.au:ab1e1e2b1d6c4711", "title": "[12]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-administration/detecting-and-mitigating-active-directory-compromises", "publisher": "Cyber GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cyber.gov.au", "key": "publisher-domain:cyber.gov.au" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:8564a831d18275de", "title": "[12]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/usao-ndca/pr/google-self-driving-car-engineer-pleads-guilty-federal-trade-secret-theft-charges", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:thedfirreport.com:46e6071836cdb511", "title": "[13]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike", "publisher": "Thedfirreport", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "thedfirreport.com", "key": "publisher-domain:thedfirreport.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:supremecourt.uk:ca156f3e6c1544c0", "title": "[13]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.supremecourt.uk/cases/uksc-2018-0213", "publisher": "Supremecourt", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "supremecourt.uk", "key": "publisher-domain:supremecourt.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:adsecurity.org:c0f86787baaf5ec5", "title": "[14]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://adsecurity.org/?p=3458", "publisher": "Adsecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "adsecurity.org", "key": "publisher-domain:adsecurity.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:8bd6029f11e067c5", "title": "[14]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/usao-ndca/pr/former-yahoo-employee-pleads-guilty-computer-intrusion", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:6bc8eed11011096a", "title": "[15]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/usao-wdwa/pr/software-engineer-sentenced-9-years-defrauding-microsoft-10-million", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:blog.binarydefense.com:bcc2ce93e00414d6", "title": "[16]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis", "publisher": "BLOG Binarydefense", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.binarydefense.com", "key": "publisher-domain:blog.binarydefense.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:priv.gc.ca:20b403917a403e17", "title": "[16]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2020/pipeda-2020-001", "publisher": "PRIV GC", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "priv.gc.ca", "key": "publisher-domain:priv.gc.ca" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:a7f58497ccedd83b", "title": "[17]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/unit42-oilrig-targets-middle-eastern-telecommunications-organization", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:72f2378fbcd78657", "title": "[17]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/usao-ndca/pr/former-twitter-employee-found-guilty-acting-agent-foreign-government-kingdom-saudi", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:f3df483e263bce52", "title": "[18]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/usao-sdny/pr/former-employee-new-york-credit-union-charged-unauthorized-computer-access-and", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cloud.google.com:f9b98fe717d92618", "title": "[19]", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2025", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" }, { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" }, { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cisa.gov:6695a16c44843926", "title": "[19]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:dl.acm.org:73f9aeb6ae10d18f", "title": "[2]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://dl.acm.org/doi/10.1145/1541880.1541882", "publisher": "DL ACM", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dl.acm.org", "key": "publisher-domain:dl.acm.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:owasp.org:c8f056d6d032bb0c", "title": "[2]", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:web.archive.org:d99078fc07d0799f", "title": "[20]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://web.archive.org/web/20230330112310/https://www.cisa.gov/sites/default/files/2022-11/Insider%20Threat%20Mitigation%20Guide_Final_508.pdf", "publisher": "WEB Archive", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "web.archive.org", "key": "publisher-domain:web.archive.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cisa.gov:37f231f3d6c95b8d", "title": "[20]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:crowdstrike.com:1018d30ea044684c", "title": "[21]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.crowdstrike.com/en-us/blog/understanding-indicators-attack-ioas-power-event-stream-processing-crowdstrike-falcon", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:dni.gov:ade6292b7caf851e", "title": "[21]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.dni.gov/files/NCSC/documents/nittf/NITTF_Insider_Threat_Program_Maturity_Framework.pdf", "publisher": "DNI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dni.gov", "key": "publisher-domain:dni.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:gdpr-info.eu:ac37cc06fe4aee0c", "title": "[22]", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://gdpr-info.eu", "publisher": "GDPR INFO", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gdpr-info.eu", "key": "publisher-domain:gdpr-info.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" }, { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:vectra.ai:adba8f5cf30a36c8", "title": "[22]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.vectra.ai/products/cognito-platform", "publisher": "Vectra", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "vectra.ai", "key": "publisher-domain:vectra.ai" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.aws.amazon.com:9e15498588f76276", "title": "[23]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:oaic.gov.au:975815356288697a", "title": "[23]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/employee-records-exemption", "publisher": "OAIC GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "oaic.gov.au", "key": "publisher-domain:oaic.gov.au" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:learn.microsoft.com:41a89dbfb36c437c", "title": "[24]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/azure/sentinel/work-with-anomaly-rules", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:fireeye.com:bf0cfdb5b4570ba3", "title": "[24]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html", "publisher": "Fireeye", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fireeye.com", "key": "publisher-domain:fireeye.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-001", "title": "[2408.03354] The Use of Large Language Models (LLM) for Cyber Threat Intelligence (CTI) in Cybercrime Forums", "description": "arXiv academic or empirical research covering Large language model. Indexed with Critical Infrastructure and Hugging Face context.", "url": "https://arxiv.org/abs/2408.03354", "publisher": "arXiv", "published_at": "2024-08", "inclusion": "context", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "background_ai_mention", "key": "ai-relevance:background-ai-mention" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "88.2% · medium confidence", "key": "metric:88.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "90% · medium confidence", "key": "metric:90-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "96.23% · medium confidence", "key": "metric:96.23-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Context only", "key": "inclusion:context-only" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Arxiv Id Month", "key": "publication-date-method:arxiv-id-month" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Month", "key": "publication-date-precision:month" }, { "facet": "Publisher", "type": "publisher", "value": "arXiv", "key": "publisher:arxiv" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "ai-cyber research or controlled study", "key": "relevance-basis:ai-cyber-research-or-controlled-study" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Source type", "type": "source_type", "value": "academic or empirical research", "key": "source-type:academic-or-empirical-research" }, { "facet": "Statistical use", "type": "statistical_use", "value": "possible_denominator", "key": "statistical-use:possible-denominator" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-002", "title": "[2410.20287] AI-Driven Cyber Threat Intelligence Automation", "description": "arXiv academic or empirical research covering Large language model. Indexed with Hugging Face context.", "url": "https://arxiv.org/abs/2410.20287", "publisher": "arXiv", "published_at": "2024-10", "inclusion": "context", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "background_ai_mention", "key": "ai-relevance:background-ai-mention" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Context only", "key": "inclusion:context-only" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Arxiv Id Month", "key": "publication-date-method:arxiv-id-month" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Month", "key": "publication-date-precision:month" }, { "facet": "Publisher", "type": "publisher", "value": "arXiv", "key": "publisher:arxiv" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "ai-cyber research or controlled study", "key": "relevance-basis:ai-cyber-research-or-controlled-study" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "academic or empirical research", "key": "source-type:academic-or-empirical-research" }, { "facet": "Statistical use", "type": "statistical_use", "value": "possible_denominator", "key": "statistical-use:possible-denominator" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "site-reference:nsa.gov:4930ea3e519bb1fc", "title": "[25]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2159615/detect-and-prevent-web-shell-malware", "publisher": "NSA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nsa.gov", "key": "publisher-domain:nsa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-003", "title": "[2502.00961] AI-Powered Spearphishing Cyber Attacks: Fact or Fiction?", "description": "arXiv academic or empirical research covering Deepfake video or image, Deepfake impersonation, and Spearphishing. Indexed with Hugging Face context.", "url": "https://arxiv.org/abs/2502.00961", "publisher": "arXiv", "published_at": "2025-02", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "43% · medium confidence", "key": "metric:43-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "66% · medium confidence", "key": "metric:66-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Arxiv Id Month", "key": "publication-date-method:arxiv-id-month" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Month", "key": "publication-date-precision:month" }, { "facet": "Publisher", "type": "publisher", "value": "arXiv", "key": "publisher:arxiv" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "ai-cyber research or controlled study", "key": "relevance-basis:ai-cyber-research-or-controlled-study" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "academic or empirical research", "key": "source-type:academic-or-empirical-research" }, { "facet": "Statistical use", "type": "statistical_use", "value": "possible_denominator", "key": "statistical-use:possible-denominator" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:ponemonsullivanreport.com:2fe215d7b7197e20", "title": "[3]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ponemonsullivanreport.com/2023/10/cost-of-insider-risks-global-report-2023", "publisher": "Ponemonsullivanreport", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ponemonsullivanreport.com", "key": "publisher-domain:ponemonsullivanreport.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:mandiant.com:613d1ca1dbc8c352", "title": "[3]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.mandiant.com/resources/sunburst-additional-technical-details", "publisher": "Mandiant", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mandiant.com", "key": "publisher-domain:mandiant.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:modelcontextprotocol.io:ceb6346b4150b579", "title": "[4]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://modelcontextprotocol.io", "publisher": "Modelcontextprotocol", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "modelcontextprotocol.io", "key": "publisher-domain:modelcontextprotocol.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:sei.cmu.edu:559e622a48d28ff8", "title": "[4]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sei.cmu.edu/library/common-sense-guide-to-mitigating-insider-threats-seventh-edition", "publisher": "SEI CMU", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sei.cmu.edu", "key": "publisher-domain:sei.cmu.edu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:microsoft.com:d386a44fb4c4c69e", "title": "[5]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2021/03/02/hafnium-targeting-exchange-servers", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:microsoft.com:1e2203cab8c61414", "title": "[6]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cloud.google.com:c79ebf6971b64ee8", "title": "[7]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/responding-to-exchange-server-zero-days", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:7aadfba32a3720de", "title": "[7]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/usao-ndca/pr/former-cisco-engineer-sentenced-two-years-federal-prison-intentionally-damaging", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cloud.google.com:935fd661dcca1865", "title": "[8]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:e6f0387ff768f965", "title": "[8]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/archives/opa/pr/former-ge-power-engineer-convicted-conspiracy-commit-economic-espionage", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:39ac05612b9cac87", "title": "[9]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/usao-sdny/pr/former-employee-ubiquiti-sentenced-six-years-prison-stealing-confidential-data-and", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:openwall.com:6d4d56fd1d94a925", "title": "[9]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4", "publisher": "Openwall", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "openwall.com", "key": "publisher-domain:openwall.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:trellix.com:af80bdb6bf216811", "title": "[R1]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.trellix.com/en-gb/blogs/research/handalas-wiper-targets-israel", "publisher": "Trellix", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "trellix.com", "key": "publisher-domain:trellix.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:t.me:2b1aa4451ced1a1e", "title": "[R10]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://t.me/HANDALA_RSS", "publisher": "T", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "t.me", "key": "publisher-domain:t.me" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:therecord.media:2a18f341eac596f6", "title": "[R12]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://therecord.media/handala-x-account-banned-twitter-palestine-iran", "publisher": "Therecord", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "therecord.media", "key": "publisher-domain:therecord.media" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:t.me:25d0d39631d2c0c0", "title": "[R18]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://t.me/s/handala_backup_357", "publisher": "T", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "t.me", "key": "publisher-domain:t.me" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:sysdig.com:7c5c218a7d364731", "title": "[R2]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sysdig.com/blog/cloud-breach-terraform-data-theft", "publisher": "Sysdig", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sysdig.com", "key": "publisher-domain:sysdig.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:research.checkpoint.com:163c4122c87a09bf", "title": "[R5]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://research.checkpoint.com/2026/2025-the-untold-stories-of-check-point-research", "publisher": "Research Checkpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cisa.gov:4aea9b63cab75d04", "title": "[R8]", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:61069822841f25d1", "title": "/blob/main/docs/full-guide-v2.md", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/threatmapper/blob/main/docs/full-guide-v2.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AdversaryGraph v2.0: I Built a Self-Hosted AI Threat Intelligence Platform", "url": "https://1200km.com/articles/read/2026/2026-06-16-adversarygraph-v2-0-i-built-a-self-hosted-ai-threat-intelligence-platform-941a80cc5a65/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:pypi.org:ec9d33dc56564e7d", "title": "1200km-aidebug on PyPI", "description": "External source cited by 1 maintained 1200km page.", "url": "https://pypi.org/project/1200km-aidebug", "publisher": "PYPI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "pypi.org", "key": "publisher-domain:pypi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "ai-attack-reference:pub-060", "title": "2024 Global Threat Report Trends and Overview", "description": "CrowdStrike threat-research report covering Influence operations, Obfuscation and evasion, and Vulnerability research. Indexed with Financial Services and Anthropic context.", "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-2024-global-threat-report/", "publisher": "CrowdStrike", "published_at": "2024-02-21", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "25 Endpoint · medium confidence", "key": "metric:25-endpoint-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "26 Endpoint · medium confidence", "key": "metric:26-endpoint-medium-confidence" }, { "facet": "Extracted metric · Breakout Time", "type": "metric", "value": "2 minutes · medium confidence", "key": "metric:2-minutes-medium-confidence" }, { "facet": "Extracted metric · Breakout Time", "type": "metric", "value": "62 minutes · medium confidence", "key": "metric:62-minutes-medium-confidence" }, { "facet": "Extracted metric · Breakout Time", "type": "metric", "value": "7 seconds · medium confidence", "key": "metric:7-seconds-medium-confidence" }, { "facet": "Extracted metric · Breakout Time", "type": "metric", "value": "84 minutes · medium confidence", "key": "metric:84-minutes-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "10 Minutes · medium confidence", "key": "metric:10-minutes-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "60% · medium confidence", "key": "metric:60-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "75% · medium confidence", "key": "metric:75-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "94% · medium confidence", "key": "metric:94-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "CrowdStrike", "key": "publisher:crowdstrike" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Password spraying", "key": "ttp:password-spraying" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-008", "title": "2024 State of Multicloud Security Report", "description": "Microsoft provider or government report covering Password spraying, Supply-chain compromise, and Generative AI. Indexed with Energy context.", "url": "https://www.microsoft.com/en-us/security/blog/2024/05/29/6-insights-from-microsofts-2024-state-of-multicloud-risk-report-to-evolve-your-security-strategy/", "publisher": "Microsoft", "published_at": "2024-05-29", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "5 domains · medium confidence", "key": "metric:5-domains-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "24 hours · medium confidence", "key": "metric:24-hours-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "57 days · medium confidence", "key": "metric:57-days-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "58 days · medium confidence", "key": "metric:58-days-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "64 days · medium confidence", "key": "metric:64-days-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$15M · medium confidence", "key": "metric:15m-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1% · medium confidence", "key": "metric:1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10% · medium confidence", "key": "metric:10-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "100% · medium confidence", "key": "metric:100-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "15% · medium confidence", "key": "metric:15-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2% · medium confidence", "key": "metric:2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "22% · medium confidence", "key": "metric:22-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "23% · medium confidence", "key": "metric:23-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "24% · medium confidence", "key": "metric:24-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "25% · medium confidence", "key": "metric:25-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3% · medium confidence", "key": "metric:3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "31% · medium confidence", "key": "metric:31-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "40% · medium confidence", "key": "metric:40-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "42% · medium confidence", "key": "metric:42-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "47% · medium confidence", "key": "metric:47-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "49% · medium confidence", "key": "metric:49-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "50% · medium confidence", "key": "metric:50-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "52% · medium confidence", "key": "metric:52-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "58% · medium confidence", "key": "metric:58-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.5% · medium confidence", "key": "metric:6.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "65% · medium confidence", "key": "metric:65-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "66% · medium confidence", "key": "metric:66-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "7% · medium confidence", "key": "metric:7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "73% · medium confidence", "key": "metric:73-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "74% · medium confidence", "key": "metric:74-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "80% · medium confidence", "key": "metric:80-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "84% · medium confidence", "key": "metric:84-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "86% · medium confidence", "key": "metric:86-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "88% · medium confidence", "key": "metric:88-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "90% · medium confidence", "key": "metric:90-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "97% · medium confidence", "key": "metric:97-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Microsoft", "key": "publisher:microsoft" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cdn-dynmedia-1.microsoft.com", "key": "publisher-domain:cdn-dynmedia-1.microsoft.com" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Energy", "key": "sector:energy" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Password spraying", "key": "ttp:password-spraying" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-095", "title": "2024 Threat Analysis and 2025 Predictions │ Recorded Future Annual Threat Report", "description": "Recorded Future threat-research report covering Identity fraud and impersonation, Influence operations, and Obfuscation and evasion. Indexed with Critical Infrastructure context.", "url": "https://www.recordedfuture.com/research/2024-annual-report", "publisher": "Recorded Future", "published_at": "2024", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Disruption / destruction", "key": "actor-motivation:disruption-/-destruction" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$459.8 million · medium confidence", "key": "metric:459.8-million-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$75 million · medium confidence", "key": "metric:75-million-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "AMOS", "key": "malware-or-tool:amos" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Url Year Only", "key": "publication-date-method:url-year-only" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Year", "key": "publication-date-precision:year" }, { "facet": "Publisher", "type": "publisher", "value": "Recorded Future", "key": "publisher:recorded-future" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-023", "title": "2025 AI Threat Report: How Cybercriminals Are Weaponizing AI Technology", "description": "KELA threat-research report covering Deepfake video or image, Deepfake voice, and Exploit development. Indexed with Storm-2139, Financial Services, and Anthropic context.", "url": "https://www.kelacyber.com/resources/research/2025-ai-threat-report/", "publisher": "KELA", "published_at": "2025-03-25", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Companion source", "type": "source_lineage", "value": "src-080", "key": "source-lineage:src-080" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-24367", "key": "cve:cve-2025-24367" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Duplicate lineage", "type": "duplicate_group", "value": "dup-003", "key": "duplicate-group:dup-003" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "100% · medium confidence", "key": "metric:100-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "200% · medium confidence", "key": "metric:200-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "219% · medium confidence", "key": "metric:219-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "51% · medium confidence", "key": "metric:51-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "52% · medium confidence", "key": "metric:52-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "95% · medium confidence", "key": "metric:95-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "DeepSeek", "key": "llm-model:deepseek" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM model", "type": "llm_model", "value": "Mistral / Mixtral", "key": "llm-model:mistral-/-mixtral" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "DeepSeek", "key": "llm-provider:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Mistral AI", "key": "llm-provider:mistral-ai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "Evil-GPT", "key": "malicious-ai-tool:evil-gpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "GhostGPT", "key": "malicious-ai-tool:ghostgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "KELA", "key": "publisher:kela" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "info.ke-la.com", "key": "publisher-domain:info.ke-la.com" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "kelacyber.com", "key": "publisher-domain:kelacyber.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "Storm-2139", "key": "threat-group:storm-2139" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "STORM-2139", "key": "threat-group-identifier:storm-2139" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6780", "key": "threat-group-identifier:unc6780" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-111", "title": "2025 APT Report: Staying Ahead of the Modern Threat Landscape", "description": "Trend Micro threat-research report covering Reconnaissance and target research, Business email compromise, and Prompt injection. Indexed with Government context.", "url": "https://www.trendmicro.com/vinfo/de/security/news/cybercrime-and-digital-threats/2025-apt-report-staying-ahead-of-the-modern-threat-landscape", "publisher": "Trend Micro", "published_at": "2026-04-16", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "2026 Email · medium confidence", "key": "metric:2026-email-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Trend Micro", "key": "publisher:trend-micro" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "trendmicro.com", "key": "publisher-domain:trendmicro.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-096", "title": "2025 Cloud Threat Hunting and Defense Landscape", "description": "Recorded Future threat-research report covering Identity fraud and impersonation, Obfuscation and evasion, and Reconnaissance and target research. Indexed with APT28 / Fancy Bear, Cryptocurrency, and Hugging Face context.", "url": "https://www.recordedfuture.com/research/2025-cloud-threat-hunting-defense-landscape", "publisher": "Recorded Future", "published_at": "2025-10-24", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Campaign", "type": "campaign", "value": "Operation SalmonSlalom", "key": "campaign:operation-salmonslalom" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-26855", "key": "cve:cve-2021-26855" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-26857", "key": "cve:cve-2021-26857" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-26858", "key": "cve:cve-2021-26858" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-27065", "key": "cve:cve-2021-27065" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-43798", "key": "cve:cve-2021-43798" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-2868", "key": "cve:cve-2023-2868" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-3519", "key": "cve:cve-2023-3519" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-7102", "key": "cve:cve-2023-7102" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-3400", "key": "cve:cve-2024-3400" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-0282", "key": "cve:cve-2025-0282" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-61882", "key": "cve:cve-2025-61882" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "approximately 1,400 accounts · medium confidence", "key": "metric:approximately-1-400-accounts-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "at least 1,494 individuals · medium confidence", "key": "metric:at-least-1-494-individuals-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "over 50 victims · medium confidence", "key": "metric:over-50-victims-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "30 days · medium confidence", "key": "metric:30-days-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1% · medium confidence", "key": "metric:1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10% · medium confidence", "key": "metric:10-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "hopto[.]org", "key": "ioc:hopto-.-org" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "my5353[.]com", "key": "ioc:my5353-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "resource[.]infinityfreeapp[.]com", "key": "ioc:resource-.-infinityfreeapp-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "stayathomeclasses[.]com", "key": "ioc:stayathomeclasses-.-com" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "FatalRAT backdoor", "key": "malware-or-tool:fatalrat-backdoor" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "LAMEHUG", "key": "malware-or-tool:lamehug" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Recorded Future", "key": "publisher:recorded-future" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT41", "key": "threat-group:apt41" }, { "facet": "Threat group", "type": "threat_group", "value": "Scattered Spider", "key": "threat-group:scattered-spider" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT28", "key": "threat-group-identifier:apt28" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT41", "key": "threat-group-identifier:apt41" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "STORM-0501", "key": "threat-group-identifier:storm-0501" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC3944", "key": "threat-group-identifier:unc3944" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC4841", "key": "threat-group-identifier:unc4841" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Fake website or service", "key": "ttp:fake-website-or-service" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Password spraying", "key": "ttp:password-spraying" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-022", "title": "2025 Global Threat Landscape Report", "description": "Fortinet threat-research report covering Deepfake video or image, Identity fraud and impersonation, and Malware development. Indexed with APT28 / Fancy Bear, Critical Infrastructure, and OpenAI context.", "url": "https://www.fortinet.com/corporate/about-us/newsroom/press-releases/2025/fortinet-threat-report-reveals-record-surge-in-automated-cyberattacks", "publisher": "Fortinet", "published_at": "2025-04-28", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "CVE", "type": "cve", "value": "CVE-2017-0147", "key": "cve:cve-2017-0147" }, { "facet": "CVE", "type": "cve", "value": "CVE-2017-18377", "key": "cve:cve-2017-18377" }, { "facet": "CVE", "type": "cve", "value": "CVE-2018-10561", "key": "cve:cve-2018-10561" }, { "facet": "CVE", "type": "cve", "value": "CVE-2019-18935", "key": "cve:cve-2019-18935" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-30525", "key": "cve:cve-2022-30525" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-1389", "key": "cve:cve-2023-1389" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-21887", "key": "cve:cve-2024-21887" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "2024, organizations · medium confidence", "key": "metric:2024-organizations-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$150, · medium confidence", "key": "metric:150-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "0.9% · medium confidence", "key": "metric:0.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.2% · medium confidence", "key": "metric:1.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.6% · medium confidence", "key": "metric:1.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1% · medium confidence", "key": "metric:1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10.5% · medium confidence", "key": "metric:10.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10.6% · medium confidence", "key": "metric:10.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10% · medium confidence", "key": "metric:10-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11.1% · medium confidence", "key": "metric:11.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11.6% · medium confidence", "key": "metric:11.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11% · medium confidence", "key": "metric:11-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12.3% · medium confidence", "key": "metric:12.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12% · medium confidence", "key": "metric:12-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "13% · medium confidence", "key": "metric:13-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "14.7% · medium confidence", "key": "metric:14.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "14% · medium confidence", "key": "metric:14-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "16.7% · medium confidence", "key": "metric:16.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "16.71% · medium confidence", "key": "metric:16.71-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "16% · medium confidence", "key": "metric:16-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "17% · medium confidence", "key": "metric:17-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "18.4% · medium confidence", "key": "metric:18.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "18% · medium confidence", "key": "metric:18-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "19% · medium confidence", "key": "metric:19-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.1% · medium confidence", "key": "metric:2.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.5% · medium confidence", "key": "metric:2.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20.2% · medium confidence", "key": "metric:20.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "21% · medium confidence", "key": "metric:21-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "25.3% · medium confidence", "key": "metric:25.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "26.3% · medium confidence", "key": "metric:26.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "26.7% · medium confidence", "key": "metric:26.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "26% · medium confidence", "key": "metric:26-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "27% · medium confidence", "key": "metric:27-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.2% · medium confidence", "key": "metric:3.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.3% · medium confidence", "key": "metric:3.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.5% · medium confidence", "key": "metric:3.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "30% · medium confidence", "key": "metric:30-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "32% · medium confidence", "key": "metric:32-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "37% · medium confidence", "key": "metric:37-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "39% · medium confidence", "key": "metric:39-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4% · medium confidence", "key": "metric:4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "42.4% · medium confidence", "key": "metric:42.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "42% · medium confidence", "key": "metric:42-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "49% · medium confidence", "key": "metric:49-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5% · medium confidence", "key": "metric:5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "50% · medium confidence", "key": "metric:50-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "500% · medium confidence", "key": "metric:500-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "55% · medium confidence", "key": "metric:55-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.1% · medium confidence", "key": "metric:6.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.8% · medium confidence", "key": "metric:6.8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6% · medium confidence", "key": "metric:6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "60% · medium confidence", "key": "metric:60-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "61% · medium confidence", "key": "metric:61-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "7.9% · medium confidence", "key": "metric:7.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "70% · medium confidence", "key": "metric:70-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8.4% · medium confidence", "key": "metric:8.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8% · medium confidence", "key": "metric:8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "88% · medium confidence", "key": "metric:88-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "9% · medium confidence", "key": "metric:9-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Cobalt Strike", "key": "malware-or-tool:cobalt-strike" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "LockBit ransomware", "key": "malware-or-tool:lockbit-ransomware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Vidar", "key": "malware-or-tool:vidar" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1059", "key": "mitre-attack-id:t1059" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1078", "key": "mitre-attack-id:t1078" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1102", "key": "mitre-attack-id:t1102" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1190", "key": "mitre-attack-id:t1190" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1496", "key": "mitre-attack-id:t1496" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1556.004", "key": "mitre-attack-id:t1556.004" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Fortinet", "key": "publisher:fortinet" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "filestore.fortinet.com", "key": "publisher-domain:filestore.fortinet.com" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "fortinet.com", "key": "publisher-domain:fortinet.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT29 / Cozy Bear", "key": "threat-group:apt29-/-cozy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT43 / Kimsuky", "key": "threat-group:apt43-/-kimsuky" }, { "facet": "Threat group", "type": "threat_group", "value": "Lazarus Group", "key": "threat-group:lazarus-group" }, { "facet": "Threat group", "type": "threat_group", "value": "RansomHub", "key": "threat-group:ransomhub" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT28", "key": "threat-group-identifier:apt28" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT29", "key": "threat-group-identifier:apt29" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT73", "key": "threat-group-identifier:apt73" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA0001", "key": "threat-group-identifier:ta0001" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA0003", "key": "threat-group-identifier:ta0003" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA0004", "key": "threat-group-identifier:ta0004" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA0007", "key": "threat-group-identifier:ta0007" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA0008", "key": "threat-group-identifier:ta0008" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA0011", "key": "threat-group-identifier:ta0011" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:crowdstrike.com:22b0f168c5b77a29", "title": "2025 Threat Hunting Report | CrowdStrike", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.crowdstrike.com/en-us/resources/reports/threat-hunting-report", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-040", "title": "2025 Unit 42 Global Incident Response Report: Social Engineering Edition", "description": "Palo Alto Networks Unit 42 operational CTI publication covering CAPTCHA bypass, Identity fraud and impersonation, and Reconnaissance and target research. Indexed with Financial Services and Anthropic context.", "url": "https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/", "publisher": "Palo Alto Networks Unit 42", "published_at": "2025-07-30", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Malicious advertisement", "key": "attack-vector:malicious-advertisement" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Smishing", "key": "attack-vector:smishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-3400", "key": "cve:cve-2024-3400" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "2000 companies · medium confidence", "key": "metric:2000-companies-medium-confidence" }, { "facet": "Extracted metric · Campaign Or Intrusion Duration", "type": "metric", "value": "40 minutes · medium confidence", "key": "metric:40-minutes-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "90 minutes · medium confidence", "key": "metric:90-minutes-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "23% · medium confidence", "key": "metric:23-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "27% · medium confidence", "key": "metric:27-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "35% · medium confidence", "key": "metric:35-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "36% · medium confidence", "key": "metric:36-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "45% · medium confidence", "key": "metric:45-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "60% · medium confidence", "key": "metric:60-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "65% · medium confidence", "key": "metric:65-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "66% · medium confidence", "key": "metric:66-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "73% · medium confidence", "key": "metric:73-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Lumma", "key": "malware-or-tool:lumma" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Palo Alto Networks Unit 42", "key": "publisher:palo-alto-networks-unit-42" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Retail", "key": "sector:retail" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Malicious advertising", "key": "ttp:malicious-advertising" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-097", "title": "2025 Year in Review: Malicious Infrastructure", "description": "Recorded Future threat-research report covering Command and control.", "url": "https://www.recordedfuture.com/research/2025-year-in-review-malicious-infrastructure", "publisher": "Recorded Future", "published_at": "2025", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Endgame", "key": "campaign:operation-endgame" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "50% · medium confidence", "key": "metric:50-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "AsyncRAT", "key": "malware-or-tool:asyncrat" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Cobalt Strike", "key": "malware-or-tool:cobalt-strike" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Lumma", "key": "malware-or-tool:lumma" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "QuasarRAT", "key": "malware-or-tool:quasarrat" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Remcos", "key": "malware-or-tool:remcos" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "REMCOS RAT", "key": "malware-or-tool:remcos-rat" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Vidar", "key": "malware-or-tool:vidar" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Year", "key": "publication-date-precision:year" }, { "facet": "Publisher", "type": "publisher", "value": "Recorded Future", "key": "publisher:recorded-future" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:microsoft.com:8a3548640ce30dec", "title": "2026 multi-stage AiTM phishing and BEC report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2026/01/21/multistage-aitm-phishing-bec-campaign-abusing-sharepoint", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:9-11commission.gov:70ebf9f59b407aad", "title": "9/11 Commission Report PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.9-11commission.gov/report/911Report.pdf", "publisher": "9 11commission", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "9-11commission.gov", "key": "publisher-domain:9-11commission.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cisa.gov:44641f4cd251731b", "title": "AA20–352A advisory on the SolarWinds-related compromise", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" }, { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:abnormal.ai:ee92f81ff84e0f25", "title": "Abnormal Security — Tracking Iran-Aligned Cyber Operations Following U.S.-Israel Strikes", "description": "External source cited by 1 maintained 1200km page.", "url": "https://abnormal.ai/blog/iran-aligned-cyber-operations-email-threats", "publisher": "Abnormal", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "abnormal.ai", "key": "publisher-domain:abnormal.ai" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:auth.abuse.ch:ec7b314cd6a0a5f3", "title": "abuse.ch Authentication", "description": "External source cited by 1 maintained 1200km page.", "url": "https://auth.abuse.ch", "publisher": "AUTH Abuse", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "auth.abuse.ch", "key": "publisher-domain:auth.abuse.ch" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "One Tool to Rule Them All: File Metadata & Static Analysis for Malware Analysts and SOC Teams", "url": "https://1200km.com/articles/read/2026/2026-02-21-one-tool-to-rule-them-all-file-metadata-and-static-analysis-for-malware-analysts-and-soc-t-c6dba1f5b7de/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:feodotracker.abuse.ch:b0252434f191cf39", "title": "Abuse.ch Feodo Tracker", "description": "External source cited by 1 maintained 1200km page.", "url": "https://feodotracker.abuse.ch", "publisher": "Feodotracker Abuse", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "feodotracker.abuse.ch", "key": "publisher-domain:feodotracker.abuse.ch" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:bazaar.abuse.ch:813003f78a135c2c", "title": "Abuse.ch MalwareBazaar", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://bazaar.abuse.ch", "publisher": "Bazaar Abuse", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "bazaar.abuse.ch", "key": "publisher-domain:bazaar.abuse.ch" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" }, { "title": "One Tool to Rule Them All: File Metadata & Static Analysis for Malware Analysts and SOC Teams", "url": "https://1200km.com/articles/read/2026/2026-02-21-one-tool-to-rule-them-all-file-metadata-and-static-analysis-for-malware-analysts-and-soc-t-c6dba1f5b7de/", "type": "article", "domain": "malware-analysis" }, { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:urlhaus.abuse.ch:cb6a8c1e1f666bac", "title": "Abuse.ch URLhaus", "description": "External source cited by 1 maintained 1200km page.", "url": "https://urlhaus.abuse.ch", "publisher": "Urlhaus Abuse", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "urlhaus.abuse.ch", "key": "publisher-domain:urlhaus.abuse.ch" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:a59b2f7e5501b60e", "title": "ADCS ESC8 Vulnerability", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/ly4k/Certipy", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "ADCS ESC8 Attack: Certificate-Based Domain Compromise — Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-01-28-adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d/", "type": "article", "domain": "network-security" }, { "title": "Cursor + Hexstrike. Fully Automated ADCS ESC8 Attack", "url": "https://1200km.com/articles/read/2026/2026-01-29-cursor-hexstrike-fully-automated-adcs-esc8-attack-8736fec53c58/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:shodan.io:c8bffaaa4afbe55b", "title": "Additional VNC Server search", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22authentication+disabled%22+%22RFB+003.008%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:clang.llvm.org:2943f06c7bded2da", "title": "AddressSanitizer", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://clang.llvm.org/docs/AddressSanitizer.html", "publisher": "Clang LLVM", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "clang.llvm.org", "key": "publisher-domain:clang.llvm.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "ai-attack-reference:pub-098", "title": "Adversarial Intelligence: Red Teaming Malicious Use Cases for AI", "description": "Recorded Future forecast or strategic assessment covering Deepfake video or image, Identity fraud and impersonation, and Influence operations.", "url": "https://www.recordedfuture.com/research/adversarial-intelligence-red-teaming-malicious-use-cases-ai", "publisher": "Recorded Future", "published_at": null, "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Unknown", "key": "publication-date-method:unknown" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Unknown", "key": "publication-date-precision:unknown" }, { "facet": "Publisher", "type": "publisher", "value": "Recorded Future", "key": "publisher:recorded-future" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat assessment, forecast, or red-team study", "key": "relevance-basis:threat-assessment-forecast-or-red-team-study" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "forecast or strategic assessment", "key": "source-type:forecast-or-strategic-assessment" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_only", "key": "statistical-use:context-only" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "Year", "type": "year", "value": "Unknown", "key": "year:unknown" } ], "used_in": [] }, { "id": "site-reference:doi.org:692b612f0ac2a67e", "title": "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, NIST AI 100-2 E2025", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://doi.org/10.6028/NIST.AI.100-2e2025", "publisher": "DOI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "doi.org", "key": "publisher-domain:doi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Engineering", "url": "https://1200km.com/ai-security-course.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "ai-attack-reference:pub-012", "title": "Adversarial Misuse of Generative AI", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering Deepfake video or image, Identity fraud and impersonation, and Malware development. Indexed with APT41, Cryptocurrency, and Google context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2025-01-30", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "13 countries · medium confidence", "key": "metric:13-countries-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "more than 20 countries · medium confidence", "key": "metric:more-than-20-countries-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "30% · medium confidence", "key": "metric:30-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "40% · medium confidence", "key": "metric:40-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Cobalt Strike", "key": "malware-or-tool:cobalt-strike" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Mimikatz", "key": "malware-or-tool:mimikatz" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT41", "key": "threat-group:apt41" }, { "facet": "Threat group", "type": "threat_group", "value": "APT42 / Charming Kitten", "key": "threat-group:apt42-/-charming-kitten" }, { "facet": "Threat group", "type": "threat_group", "value": "APT43 / Kimsuky", "key": "threat-group:apt43-/-kimsuky" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT41", "key": "threat-group-identifier:apt41" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT42", "key": "threat-group-identifier:apt42" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT43", "key": "threat-group-identifier:apt43" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" }, { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" }, { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" }, { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-015", "title": "Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering Autonomous or agentic intrusion, CAPTCHA bypass, and Deepfake video or image. Indexed with Financial Services and Anthropic context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2026-05-12", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Autonomous or agentic intrusion", "key": "ai-use-case:autonomous-or-agentic-intrusion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Overload", "key": "campaign:operation-overload" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PromptFlux", "key": "malware-or-tool:promptflux" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PROMPTSPY", "key": "malware-or-tool:promptspy" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0008.000", "key": "mitre-attack-id:t0008.000" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0008.005", "key": "mitre-attack-id:t0008.005" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0010.001", "key": "mitre-attack-id:t0010.001" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0016.001", "key": "mitre-attack-id:t0016.001" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0016.002", "key": "mitre-attack-id:t0016.002" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0021", "key": "mitre-attack-id:t0021" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0040", "key": "mitre-attack-id:t0040" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0054", "key": "mitre-attack-id:t0054" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0072", "key": "mitre-attack-id:t0072" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0088", "key": "mitre-attack-id:t0088" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0102", "key": "mitre-attack-id:t0102" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0103", "key": "mitre-attack-id:t0103" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1027.014", "key": "mitre-attack-id:t1027.014" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1027.016", "key": "mitre-attack-id:t1027.016" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1090.003", "key": "mitre-attack-id:t1090.003" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1566", "key": "mitre-attack-id:t1566" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1587.001", "key": "mitre-attack-id:t1587.001" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1587.004", "key": "mitre-attack-id:t1587.004" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1588.002", "key": "mitre-attack-id:t1588.002" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1588.005", "key": "mitre-attack-id:t1588.005" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1588.006", "key": "mitre-attack-id:t1588.006" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1588.007", "key": "mitre-attack-id:t1588.007" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1591.002", "key": "mitre-attack-id:t1591.002" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1591.004", "key": "mitre-attack-id:t1591.004" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1592.001", "key": "mitre-attack-id:t1592.001" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Media", "key": "sector:media" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT27", "key": "threat-group-identifier:apt27" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT45", "key": "threat-group-identifier:apt45" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC2814", "key": "threat-group-identifier:unc2814" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC5673", "key": "threat-group-identifier:unc5673" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6201", "key": "threat-group-identifier:unc6201" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6780", "key": "threat-group-identifier:unc6780" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Ransomware deployment", "key": "ttp:ransomware-deployment" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "site-reference:caldera.mitre.org:febb9370de699d94", "title": "Adversary Emulation", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://caldera.mitre.org", "publisher": "Caldera Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "caldera.mitre.org", "key": "publisher-domain:caldera.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:205dd33efb8d08ee", "title": "AdversaryGraph Usecases", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/adversarygraph-usecases-820d03c3a7ab", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AdversaryGraph Usecases", "url": "https://1200km.com/articles/read/2026/2026-06-19-adversarygraph-usecases-820d03c3a7ab/", "type": "article", "domain": "ai-security" }, { "title": "AdversaryGraph v2.5: New Name, New Release, Full AI CTI Platform Capability Map", "url": "https://1200km.com/articles/read/2026/2026-06-19-adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:809a2475ff3910ec", "title": "AdversaryGraph v2.5: New Name, New Release, Full AI CTI Platform Capability Map", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "AdversaryGraph Usecases", "url": "https://1200km.com/articles/read/2026/2026-06-19-adversarygraph-usecases-820d03c3a7ab/", "type": "article", "domain": "ai-security" }, { "title": "Historical: AdversaryGraph v4 Capability Map", "url": "https://1200km.com/articles/adversarygraph-v2-self-hosted-ai-cti-platform.html", "type": "mirror", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:e70378668be8d0f2", "title": "AdversaryGraph v5.0: From CTI Mapping to Attack Simulation and SIEM Validation", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://medium.com/@1200km/adversarygraph-v5-0-from-cti-mapping-to-attack-simulation-and-siem-validation-21873b2a6c39", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph Platform Guide", "url": "https://1200km.com/adversarygraph-docs/platform-guide/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Attack Simulation", "url": "https://1200km.com/adversarygraph-docs/attack-simulation/", "type": "documentation", "domain": "platform-documentation" }, { "title": "CTI-to-detection workbench for teams that need evidence, not guesswork", "url": "https://1200km.com/adversarygraph-docs/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Roadmap", "url": "https://1200km.com/adversarygraph-docs/roadmap/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:13bc89058575daf4", "title": "adversarygraph/docs/malware-analysis-guide.md at main · anpa1200/adversarygraph", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph/blob/main/docs/malware-analysis-guide.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "AdversaryGraph v4.0: I Added a Full Malware Analysis Workbench to My Self-Hosted CTI Platform", "url": "https://1200km.com/articles/read/2026/2026-06-26-adversarygraph-v4-0-i-added-a-full-malware-analysis-workbench-to-my-self-hosted-cti-platfo-8dfbf1db2c9e/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "ai-attack-reference:pub-041", "title": "AI Agents Are Here. So Are the Threats.", "description": "Palo Alto Networks Unit 42 operational CTI publication covering CAPTCHA bypass, Identity fraud and impersonation, and Command and control. Indexed with Anthropic context.", "url": "https://unit42.paloaltonetworks.com/agentic-ai-threats/", "publisher": "Palo Alto Networks Unit 42", "published_at": "2025-05-01", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "30 days · medium confidence", "key": "metric:30-days-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "60 days · medium confidence", "key": "metric:60-days-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "badnews[.]xyz", "key": "ioc:badnews-.-xyz" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Palo Alto Networks Unit 42", "key": "publisher:palo-alto-networks-unit-42" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Vulnerability scanning", "key": "ttp:vulnerability-scanning" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-013", "title": "AI Enhancing Your Adversarial Emulation", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering Reconnaissance and target research, Supply-chain compromise, and Target research / OSINT. Indexed with Financial Services and Google context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-enhancing-your-adversarial-emulation", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2024-11-15", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "120 users · medium confidence", "key": "metric:120-users-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "400 systems · medium confidence", "key": "metric:400-systems-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "900 users · medium confidence", "key": "metric:900-users-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "about 900 users · medium confidence", "key": "metric:about-900-users-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1% · medium confidence", "key": "metric:1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2% · medium confidence", "key": "metric:2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "21% · medium confidence", "key": "metric:21-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "23% · medium confidence", "key": "metric:23-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "28% · medium confidence", "key": "metric:28-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3% · medium confidence", "key": "metric:3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "30% · medium confidence", "key": "metric:30-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4% · medium confidence", "key": "metric:4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "46% · medium confidence", "key": "metric:46-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "47% · medium confidence", "key": "metric:47-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "49% · medium confidence", "key": "metric:49-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-035", "title": "AI in the Middle: Turning Web-Based AI Services into C2 Proxies & The Future Of AI Driven Attacks - Check Point Research", "description": "Check Point forecast or strategic assessment covering CAPTCHA bypass, Command and control, and Malware development. Indexed with Critical Infrastructure and Anthropic context.", "url": "https://research.checkpoint.com/2026/ai-in-the-middle-turning-web-based-ai-services-into-c2-proxies-the-future-of-ai-driven-attacks/", "publisher": "Check Point", "published_at": "2026-02-17", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Command and control", "key": "ai-use-case:command-and-control" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "11 systems · medium confidence", "key": "metric:11-systems-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM model", "type": "llm_model", "value": "Grok", "key": "llm-model:grok" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "xAI", "key": "llm-provider:xai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Check Point", "key": "publisher:check-point" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat assessment, forecast, or red-team study", "key": "relevance-basis:threat-assessment-forecast-or-red-team-study" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Source type", "type": "source_type", "value": "forecast or strategic assessment", "key": "source-type:forecast-or-strategic-assessment" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_only", "key": "statistical-use:context-only" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:medium.com:f8bd69d9baf5bad1", "title": "AI Security Course, Module 00 — Chapter 2", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/ai-security-course-module-00-chapter-2-69381c74a59c", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "I’m Building an AI Security Engineering Course", "url": "https://1200km.com/articles/read/2026/2026-07-31-i-m-building-an-ai-security-engineering-course-55e29e6c035e/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:f4e730f53d70022d", "title": "AI Security Course, Module 00 — Chapter 4 ↗", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/ai-security-course-module-00-chapter-4-b8e3de0c3a9d", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:cc3a8c748821a0f1", "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-and-data-foundations-2e26c0740a17", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "I’m Building an AI Security Engineering Course", "url": "https://1200km.com/articles/read/2026/2026-07-31-i-m-building-an-ai-security-engineering-course-55e29e6c035e/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:genai.owasp.org:03c1d5172bb39d40", "title": "AI Security Glossary", "description": "External source cited by 1 maintained 1200km page.", "url": "https://genai.owasp.org/glossary", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI, Machine Learning & LLM Foundations", "url": "https://1200km.com/ai-security-course/module-00.html", "type": "research", "domain": "ai-security" } ] }, { "id": "ai-attack-reference:pub-055", "title": "AI Security Report 2025", "description": "Check Point provider or government report covering Agentic AI. Indexed with Financial Services context.", "url": "https://www.checkpoint.com/resources/all-assets-460c/report-ai-security-report-2025?fw=c778b", "publisher": "Check Point", "published_at": "2025-04-30", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "100% · medium confidence", "key": "metric:100-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "IOC · Md5", "type": "ioc", "value": "8fe6d620a2ec11f1892ca9ec6d1bc182", "key": "ioc:8fe6d620a2ec11f1892ca9ec6d1bc182" }, { "facet": "IOC · Md5", "type": "ioc", "value": "8fe6fc70a2ec11f1a7370f68f28e8e46", "key": "ioc:8fe6fc70a2ec11f1a7370f68f28e8e46" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Check Point", "key": "publisher:check-point" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "checkpoint.com", "key": "publisher-domain:checkpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-059", "title": "AI vs AI: The Cybersecurity Arms Race", "description": "CrowdStrike threat-research report covering Command and control, Deepfake video or image, and Deepfake voice. Indexed with Financial Services and Anthropic context.", "url": "https://www.crowdstrike.com/en-us/blog/ai-vs-ai-cybersecurity-arms-race/", "publisher": "CrowdStrike", "published_at": "2025-08-04", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Command and control", "key": "ai-use-case:command-and-control" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "25 Endpoint · medium confidence", "key": "metric:25-endpoint-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "26 Endpoint · medium confidence", "key": "metric:26-endpoint-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "10 Minutes · medium confidence", "key": "metric:10-minutes-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12% · medium confidence", "key": "metric:12-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "54% · medium confidence", "key": "metric:54-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "94% · medium confidence", "key": "metric:94-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PoisonIvy malware", "key": "malware-or-tool:poisonivy-malware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "CrowdStrike", "key": "publisher:crowdstrike" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Script generation", "key": "ttp:script-generation" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-014", "title": "AI-Powered Voice Spoofing for Next-Gen Vishing Attacks", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering CAPTCHA bypass, Deepfake video or image, and Deepfake voice. Indexed with Financial Services context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-powered-voice-spoofing-vishing-attacks", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2024-07-24", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$200 million · medium confidence", "key": "metric:200-million-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "site-reference:aicpa-cima.com:37b7301776ff052c", "title": "AICPA SOC suite overview", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.aicpa-cima.com/soc", "publisher": "Aicpa CIMA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aicpa-cima.com", "key": "publisher-domain:aicpa-cima.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:github.com:d2710214eda87eb8", "title": "AIDebug 3.1 release notes in source", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/AIDebug/blob/cd81ef242db0bcea3296970d45c241a4228d2d27/docs/release-notes/v3.1.0.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:github.com:8b15681403540431", "title": "AIDebug 3.1 String Intelligence release notes", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/AIDebug/blob/main/docs/release-notes/v3.1.0.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Strings Analysis for Malware Analysis: Turning Binary Text into Defensible Hypotheses", "url": "https://1200km.com/articles/read/2026/2026-08-12-strings-analysis-for-malware-analysis-turning-391815ee35e2/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:895b0b6df3eb36a2", "title": "AIDebug releases", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/AIDebug/releases", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:github.com:786d85718bd80474", "title": "AIDebug safety model", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/AIDebug/blob/cd81ef242db0bcea3296970d45c241a4228d2d27/docs/safety-model.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:github.com:8817bd691fb0803b", "title": "AIDebug validation plan", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/AIDebug/blob/cd81ef242db0bcea3296970d45c241a4228d2d27/docs/validation-plan.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:akamai.com:e42e81a6f1bddd09", "title": "Akamai InfectedSlurs / Mirai zero-day", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.akamai.com/blog/security-research/new-rce-botnet-spreads-mirai-via-zero-days", "publisher": "Akamai", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "akamai.com", "key": "publisher-domain:akamai.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "ai-attack-reference:pub-104", "title": "AkiraBot | AI-Powered Bot Bypasses CAPTCHAs, Spams Websites At Scale | SentinelOne", "description": "SentinelOne operational CTI publication covering CAPTCHA bypass, Malicious advertising, and Large language model. Indexed with Akira, Financial Services, and OpenAI context.", "url": "https://www.sentinelone.com/labs/akirabot-ai-powered-bot-bypasses-captchas-spams-websites-at-scale/", "publisher": "SentinelOne", "published_at": "2025-04-09", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Malicious advertisement", "key": "attack-vector:malicious-advertisement" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "11,000 domains · medium confidence", "key": "metric:11-000-domains-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "at least 80,000 websites · medium confidence", "key": "metric:at-least-80-000-websites-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "more than 400,000 websites · medium confidence", "key": "metric:more-than-400-000-websites-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "17 years · medium confidence", "key": "metric:17-years-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "4 years · medium confidence", "key": "metric:4-years-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "5 days · medium confidence", "key": "metric:5-days-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "akirateam[.]com", "key": "ioc:akirateam-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "bodis[.]com", "key": "ioc:bodis-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "firstpageprofs[.]com", "key": "ioc:firstpageprofs-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "getkira[.]info", "key": "ioc:getkira-.-info" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "go-servicewrap[.]com", "key": "ioc:go-servicewrap-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "gogoservicewrap[.]com", "key": "ioc:gogoservicewrap-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "goservicewrap[.]com", "key": "ioc:goservicewrap-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "joinnowkira[.]org", "key": "ioc:joinnowkira-.-org" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "joinservicewrap[.]com", "key": "ioc:joinservicewrap-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "joinuseakira[.]com", "key": "ioc:joinuseakira-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "kiraone[.]info", "key": "ioc:kiraone-.-info" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "letsgetcustomers[.]com", "key": "ioc:letsgetcustomers-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "loveservice-wrap[.]com", "key": "ioc:loveservice-wrap-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "mybkira[.]info", "key": "ioc:mybkira-.-info" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "onlyforyoursite[.]com", "key": "ioc:onlyforyoursite-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "searchengineboosters[.]com", "key": "ioc:searchengineboosters-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "service-wrap[.]com", "key": "ioc:service-wrap-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "servicewrap-go[.]com", "key": "ioc:servicewrap-go-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "servicewrapgo[.]com", "key": "ioc:servicewrapgo-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "servicewrapone[.]com", "key": "ioc:servicewrapone-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "theakirateam[.]com", "key": "ioc:theakirateam-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "topservicewrap[.]com", "key": "ioc:topservicewrap-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "useakira[.]com", "key": "ioc:useakira-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "usekiara[.]com", "key": "ioc:usekiara-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "useproakira[.]com", "key": "ioc:useproakira-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "usethatakira[.]com", "key": "ioc:usethatakira-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "wantkiara[.]info", "key": "ioc:wantkiara-.-info" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "wearetherealpros[.]com", "key": "ioc:wearetherealpros-.-com" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "09ec44b6d3555a0397142b4308825483b479bf5a", "key": "ioc:09ec44b6d3555a0397142b4308825483b479bf5a" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "0de065d58b367ffb28ce53bc1dc023f95a6d0b89", "key": "ioc:0de065d58b367ffb28ce53bc1dc023f95a6d0b89" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "13de9fcd4e7c36d32594924975b7ef2b91614556", "key": "ioc:13de9fcd4e7c36d32594924975b7ef2b91614556" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "2322964ea57312747ae9d1e918811201a0c86e9c", "key": "ioc:2322964ea57312747ae9d1e918811201a0c86e9c" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "253684ea43cb0456a6fec5728e1091ff8fcb27cf", "key": "ioc:253684ea43cb0456a6fec5728e1091ff8fcb27cf" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "36b4e424ce8082d7606bb9f677f97c0f594f254d", "key": "ioc:36b4e424ce8082d7606bb9f677f97c0f594f254d" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "3a443c72995254400da30fe203f3fbf287629969", "key": "ioc:3a443c72995254400da30fe203f3fbf287629969" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "3a7cc815b921166006f31c1065dadfeb8d5190e6", "key": "ioc:3a7cc815b921166006f31c1065dadfeb8d5190e6" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "4d24dd5c166fa471554ed781180e353e6b9642b7", "key": "ioc:4d24dd5c166fa471554ed781180e353e6b9642b7" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "51ec20e5356bbebd43c03faae56fca4c3bbe318e", "key": "ioc:51ec20e5356bbebd43c03faae56fca4c3bbe318e" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "55affc664472c4657c8534e0508636394eac8828", "key": "ioc:55affc664472c4657c8534e0508636394eac8828" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "5620b527dfc71e2ee7efb2e22a0441b60fd67b84", "key": "ioc:5620b527dfc71e2ee7efb2e22a0441b60fd67b84" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "5fde3180373c420cfa5cfdea7f227a1e1fe6936c", "key": "ioc:5fde3180373c420cfa5cfdea7f227a1e1fe6936c" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "62e66bae4b892593009d5261d898356b6d0be3ef", "key": "ioc:62e66bae4b892593009d5261d898356b6d0be3ef" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "6b65c296d9e1cda5af2f7dab94ce8e163b2a4ca8", "key": "ioc:6b65c296d9e1cda5af2f7dab94ce8e163b2a4ca8" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "6c56b986893dd1de83151510f4b6260613c5fbb9", "key": "ioc:6c56b986893dd1de83151510f4b6260613c5fbb9" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "6f342ff77cd43921210d144a403b8abb1e541a8b", "key": "ioc:6f342ff77cd43921210d144a403b8abb1e541a8b" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "7129194c63ae262c814da8045879aed7a037f196", "key": "ioc:7129194c63ae262c814da8045879aed7a037f196" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "71464c4f145c9a43ade999d385a9260aabcbf66d", "key": "ioc:71464c4f145c9a43ade999d385a9260aabcbf66d" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "730192b0f62e37d4d57bae9ff14ec8671fbf051e", "key": "ioc:730192b0f62e37d4d57bae9ff14ec8671fbf051e" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "769aa6ab69154ca87ccba0535e0180a985c21a0c", "key": "ioc:769aa6ab69154ca87ccba0535e0180a985c21a0c" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "76aab3ab0f3f16cf30d7913ff767f67a116ff1e7", "key": "ioc:76aab3ab0f3f16cf30d7913ff767f67a116ff1e7" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "853fde052316be7887474996538b31f6ac0c3963", "key": "ioc:853fde052316be7887474996538b31f6ac0c3963" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "9d43494c6f87414c67533cce5ec86754311631fc", "key": "ioc:9d43494c6f87414c67533cce5ec86754311631fc" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "9f6ed2427e959e92eb1699024f457d87fa7b5279", "key": "ioc:9f6ed2427e959e92eb1699024f457d87fa7b5279" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "aa72065673dc543e6bf627c7479bfe8a5e42a9c4", "key": "ioc:aa72065673dc543e6bf627c7479bfe8a5e42a9c4" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "aac26242f4209bc59c82c8f223fcf2f152ce44bc", "key": "ioc:aac26242f4209bc59c82c8f223fcf2f152ce44bc" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "b643a1f2c4eb436db26763d5e2527f6bebe8bcbf", "key": "ioc:b643a1f2c4eb436db26763d5e2527f6bebe8bcbf" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "bbd754e36aee4702b9f20b90d509248945add4ea", "key": "ioc:bbd754e36aee4702b9f20b90d509248945add4ea" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "cb194612ed003eaf8d8cf6ed3731f21f3edeb161", "key": "ioc:cb194612ed003eaf8d8cf6ed3731f21f3edeb161" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "cc63ee921c29f47612096c34d6ee3ef244b33db2", "key": "ioc:cc63ee921c29f47612096c34d6ee3ef244b33db2" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "e12c6911997d7c2af5550b7e989f1dc57b6733b8", "key": "ioc:e12c6911997d7c2af5550b7e989f1dc57b6733b8" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "eae675812c4274502051d6f2d36348f77a8464a0", "key": "ioc:eae675812c4274502051d6f2d36348f77a8464a0" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "f1c7c5d0870fd0abb7e419f2c2ba8df42fa74667", "key": "ioc:f1c7c5d0870fd0abb7e419f2c2ba8df42fa74667" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "f2e71c9cbc4a18482a11ca3f54f2c958973360b4", "key": "ioc:f2e71c9cbc4a18482a11ca3f54f2c958973360b4" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "fb7fdcc2fe11e95065a0ce9041348984427ca0f4", "key": "ioc:fb7fdcc2fe11e95065a0ce9041348984427ca0f4" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "AkiraBot", "key": "malware-or-tool:akirabot" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "BlackBasta ransomware", "key": "malware-or-tool:blackbasta-ransomware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "SentinelOne", "key": "publisher:sentinelone" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "Akira", "key": "threat-group:akira" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Malicious advertising", "key": "ttp:malicious-advertising" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:otx.alienvault.com:b6fa7607ba9e82c1", "title": "AlienVault OTX", "description": "External source cited by 1 maintained 1200km page.", "url": "https://otx.alienvault.com", "publisher": "OTX Alienvault", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "otx.alienvault.com", "key": "publisher-domain:otx.alienvault.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:amd.com:bbdf75c5d45fcd2b", "title": "AMD-SB-3019 SEV firmware (EntrySign companion, CVE-2024–56161)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html", "publisher": "AMD", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "amd.com", "key": "publisher-domain:amd.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:amd.com:bb96605b69e1240f", "title": "AMD-SB-3034 SEV-SNP routing misconfiguration (“Fabricked”, CVE-2025–54510)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3034.html", "publisher": "AMD", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "amd.com", "key": "publisher-domain:amd.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:amd.com:71bafbf431c09788", "title": "AMD-SB-7033 microcode signature verification (EntrySign, CVE-2024–36347)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html", "publisher": "AMD", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "amd.com", "key": "publisher-domain:amd.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:github.com:eba2f2f48d5eee2b", "title": "An example configuration file can be found here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/owasp-amass/amass/blob/master/examples/config.yaml", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "OWASP Amass Project guide", "url": "https://1200km.com/articles/read/2024/2024-11-06-owasp-amass-project-guide-94bd55521f91/", "type": "article", "domain": "application-security" } ] }, { "id": "ai-attack-reference:pub-024", "title": "An update on disrupting deceptive uses of AI", "description": "OpenAI operational CTI publication covering Influence operations. Indexed with OpenAI context.", "url": "https://openai.com/global-affairs/an-update-on-disrupting-deceptive-uses-of-ai/", "publisher": "OpenAI", "published_at": "2024-10-09", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "OpenAI", "key": "publisher:openai" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-043", "title": "Analyzing the Current State of AI Use in Malware", "description": "Palo Alto Networks Unit 42 operational CTI publication covering Autonomous or agentic intrusion, CAPTCHA bypass, and Malware development. Indexed with Anthropic context.", "url": "https://unit42.paloaltonetworks.com/ai-use-in-malware/", "publisher": "Palo Alto Networks Unit 42", "published_at": "2026-03-19", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Autonomous or agentic intrusion", "key": "ai-use-case:autonomous-or-agentic-intrusion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "2 seconds · medium confidence", "key": "metric:2-seconds-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "5 seconds · medium confidence", "key": "metric:5-seconds-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "100 % · medium confidence", "key": "metric:100-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "02ce798981fb2aa68776e53672a24103579ca77a1d3e7f8aaeccf6166d1a9cc6", "key": "ioc:02ce798981fb2aa68776e53672a24103579ca77a1d3e7f8aaeccf6166d1a9cc6" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "052d5220529b6bd4b01e5e375b5dc3ffd50c4b137e242bbfb26655fd7f475ac6", "key": "ioc:052d5220529b6bd4b01e5e375b5dc3ffd50c4b137e242bbfb26655fd7f475ac6" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "1b6326857fa635d396851a9031949cfdf6c806130767c399727d78a1c2a0126c", "key": "ioc:1b6326857fa635d396851a9031949cfdf6c806130767c399727d78a1c2a0126c" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "7c7b7b99f248662a1f9aea1563e60f90d19b0ee95934e476c423d0bf373f6493", "key": "ioc:7c7b7b99f248662a1f9aea1563e60f90d19b0ee95934e476c423d0bf373f6493" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Palo Alto Networks Unit 42", "key": "publisher:palo-alto-networks-unit-42" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:androguard.readthedocs.io:8792add88458980c", "title": "androguard.readthedocs.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://androguard.readthedocs.io/en/latest", "publisher": "Androguard Readthedocs", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "androguard.readthedocs.io", "key": "publisher-domain:androguard.readthedocs.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:developer.android.com:d80335cca6118df2", "title": "Android Developers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://developer.android.com/studio/install", "publisher": "Developer Android", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "developer.android.com", "key": "publisher-domain:developer.android.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:64497aad849e2208", "title": "Anomaly research", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-based-90df8b6dea12", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:any.run:6e23852cea4d0994", "title": "any.run", "description": "External source cited by 1 maintained 1200km page.", "url": "https://any.run/report/5d1e3b113e15fc5fd4a08f41e553b8fd0eaace74b6dc034e0f6237c5e10aa737/8928117d-88c9-4d33-aae9-3a7822a2bf1f", "publisher": "ANY", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "any.run", "key": "publisher-domain:any.run" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:a34087b5eb1cd5ca", "title": "API key here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/laramies/theHarvester?tab=readme-ov-file", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" } ], "used_in": [ { "title": "theHarvester: Your Essential Tool for OSINT and Reconnaissance in Cybersecurity", "url": "https://1200km.com/articles/read/2024/2024-11-07-theharvester-your-essential-tool-for-osint-and-reconnaissance-in-cybersecurity-10aa6d76f5b3/", "type": "article", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:apktool.org:c8a05e0f0e183a9a", "title": "apktool.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://apktool.org/docs/install", "publisher": "Apktool", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "apktool.org", "key": "publisher-domain:apktool.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:app.any.run:1df81af8e37d3eb0", "title": "app.any.run", "description": "External source cited by 1 maintained 1200km page.", "url": "https://app.any.run", "publisher": "APP ANY", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "app.any.run", "key": "publisher-domain:app.any.run" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:apwg.org:feeb76cd5c9bb441", "title": "apwg.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://apwg.org/trendsreports", "publisher": "APWG", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "apwg.org", "key": "publisher-domain:apwg.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:aquasec.com:2edb77ba239f3b6d", "title": "aquasec.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.aquasec.com/blog/threat-alert-kinsing-malware-container-vulnerability", "publisher": "Aquasec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aquasec.com", "key": "publisher-domain:aquasec.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:modelcontextprotocol.io:172e80d748294bb7", "title": "Architecture overview", "description": "External source cited by 1 maintained 1200km page.", "url": "https://modelcontextprotocol.io/docs/learn/architecture", "publisher": "Modelcontextprotocol", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "modelcontextprotocol.io", "key": "publisher-domain:modelcontextprotocol.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI, Machine Learning & LLM Foundations", "url": "https://1200km.com/ai-security-course/module-00.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:doi.org:33d25b306e1a92cb", "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://doi.org/10.6028/NIST.AI.600-1", "publisher": "DOI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "doi.org", "key": "publisher-domain:doi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:bgp.he.net:c20d0064fad24d76", "title": "AS13335", "description": "External source cited by 1 maintained 1200km page.", "url": "https://bgp.he.net/AS13335", "publisher": "BGP HE", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "bgp.he.net", "key": "publisher-domain:bgp.he.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:arxiv.org:50db64a2735383a2", "title": "Athalye, Carlini, and Wagner — Obfuscated Gradients Give a False Sense of Security", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1802.00420", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:6bfcc6dce3544b35", "title": "ATLAS content release 2026.07 (Git tag v2026.07 )", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.07", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:attack.mitre.org:7ea811d5605f0526", "title": "ATT&CK detection strategies", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/detectionstrategies", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:attack.mitre.org:902b64df12d7da45", "title": "attack.mitre.org", "description": "External source cited by 15 maintained 1200km pages.", "url": "https://attack.mitre.org", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" }, { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" }, { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" }, { "title": "CTI Analyst Field Manual — Complete Reference", "url": "https://1200km.com/articles/read/2026/2026-05-18-cti-analyst-field-manual-complete-reference-ef2a370bb21f/", "type": "article", "domain": "detection-engineering" }, { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" }, { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" }, { "title": "SPW AW25 — PO.010 SMS.exe.exe (AgentTesla)", "url": "https://1200km.com/articles/read/2025/2025-03-24-spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295/", "type": "article", "domain": "malware-analysis" }, { "title": "The Complete Guide to AI-Driven Penetration Testing: Cursor, MCP, and the Modern PT Workflow", "url": "https://1200km.com/articles/read/2026/2026-02-19-the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca/", "type": "article", "domain": "offensive-research" }, { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" }, { "title": "Threat Matrix", "url": "https://1200km.com/adversarygraph-web-guide.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:attack.mitre.org:ce8bb2be50d7510c", "title": "attack.mitre.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/tactics/TA0001", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "Endpoint Threat Hunting: Proactive Detection on Windows, Linux, and macOS", "url": "https://1200km.com/articles/read/2025/2025-12-14-endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:attack.mitre.org:60d50e6437f88b41", "title": "attack.mitre.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/techniques/T1098/007", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:attack.mitre.org:afbd68c8aedca982", "title": "attack.mitre.org/groups", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/groups", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Attribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution", "url": "https://1200km.com/articles/read/2026/2026-03-20-attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:arxiv.org:a7468c6851652691", "title": "Attention Is All You Need", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://arxiv.org/abs/1706.03762", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:aclanthology.org:330e6fc1bcc4c81b", "title": "Attention is not Explanation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://aclanthology.org/N19-1357", "publisher": "Aclanthology", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aclanthology.org", "key": "publisher-domain:aclanthology.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:beyondmachines.net:dff52b96144ba087", "title": "authentication bypass", "description": "External source cited by 1 maintained 1200km page.", "url": "https://beyondmachines.net/event_details/critical-authentication-bypass-vulnerability-in-ami-megarac-bmc-software-r-z-3-c-r", "publisher": "Beyondmachines", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "beyondmachines.net", "key": "publisher-domain:beyondmachines.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:github.com:0b9eabac5aacdeb9", "title": "Authoritative v7.0 source guide", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph/blob/2a9a7bedf6115dbcfbf1e90a70e08f50d76e8c73/docs/unified-rag-and-mcp.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Unified Intelligence RAG and MCP", "url": "https://1200km.com/adversarygraph-docs/unified-rag-mcp/", "type": "documentation", "domain": "threat-intelligence" } ] }, { "id": "site-reference:offsec.com:83aa148b30724f21", "title": "Auxiliary Module Reference - Metasploit Unleashed *The Metasploit Framework includes hundreds of auxiliary modules that perform scanning, fuzzing, sniffing, and much…*www.offsec.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.offsec.com/metasploit-unleashed/auxiliary-module-reference", "publisher": "Offsec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "offsec.com", "key": "publisher-domain:offsec.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Metasploit modules guide. Auxiliary", "url": "https://1200km.com/articles/read/2024/2024-11-18-metasploit-modules-guide-auxiliary-1821db1712f0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:docs.aws.amazon.com:57cdaf441a57530f", "title": "aws — AWS CLI 2.27.47 Command Reference", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/cli/latest/reference/index.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Sending EKS Control Plane Logs via AWS Lambda", "url": "https://1200km.com/articles/read/2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.aws.amazon.com:f2288c62e5f79ff6", "title": "AWS EFS + EKS", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/eks/latest/userguide/efs-csi.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:docs.aws.amazon.com:231ba2678238f37d", "title": "AWS Fargate for Amazon EKS — Considerations | AWS Documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/eks/latest/userguide/fargate.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.aws.amazon.com:1cc194680a9e464a", "title": "AWS forensics in incident response", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture-cyber-forensics/forensics-ir.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:console.aws.amazon.com:6ff162ff800222f3", "title": "AWS Lambda Console", "description": "External source cited by 1 maintained 1200km page.", "url": "https://console.aws.amazon.com/lambda", "publisher": "Console AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "console.aws.amazon.com", "key": "publisher-domain:console.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Sending EKS Control Plane Logs via AWS Lambda", "url": "https://1200km.com/articles/read/2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.aws.amazon.com:ee147597bb0e4131", "title": "AWS Well-Architected Security Pillar", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/shared-responsibility.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:learn.microsoft.com:c0d47152e6ccc887", "title": "Azure AD security operations guide", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/entra/architecture/security-operations-introduction", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "ITDR Professional Roadmap", "url": "https://1200km.com/ITDR/docs/roadmap/", "type": "documentation", "domain": "identity-security" } ] }, { "id": "site-reference:learn.microsoft.com:6c9984cf2b29f7f5", "title": "Azure shared responsibility", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:learn.microsoft.com:9927f54ba25624e4", "title": "Azure Well-Architected Security Pillar", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://learn.microsoft.com/en-us/azure/well-architected/security", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:raw.githubusercontent.com:7e1d63249f6296ca", "title": "azure-ad/signin-p.levi.json", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/azure-ad/signin-p.levi.json", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-112", "title": "Back to the Hype: An Update on How Cybercriminals Are Using GenAI", "description": "Trend Micro threat-research report covering Deepfake video or image, Identity fraud and impersonation, and Translation and localization. Indexed with Cryptocurrency and Hugging Face context.", "url": "https://www.trendaisecurity.com/en-gb/resources-insights/deep-research/back-to-the-hype-an-update-on-how-cybercriminals-are-using-genai", "publisher": "Trend Micro", "published_at": "2023-08", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "24 months · medium confidence", "key": "metric:24-months-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "US$10 · medium confidence", "key": "metric:us-10-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "US$500 · medium confidence", "key": "metric:us-500-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "92% · medium confidence", "key": "metric:92-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "97% · medium confidence", "key": "metric:97-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text Month", "key": "publication-date-method:text-month" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Month", "key": "publication-date-precision:month" }, { "facet": "Publisher", "type": "publisher", "value": "Trend Micro", "key": "publisher:trend-micro" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "trendaisecurity.com", "key": "publisher-domain:trendaisecurity.com" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "trendmicro.com", "key": "publisher-domain:trendmicro.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "Year", "type": "year", "value": "2023", "key": "year:2023" } ], "used_in": [] }, { "id": "site-reference:ipvm.com:8d8616c1da75f8f1", "title": "Backdoor exploit details", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ipvm.com/reports/hik-exploit", "publisher": "IPVM", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ipvm.com", "key": "publisher-domain:ipvm.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:cloud.google.com:ead3c3226f6fb4c0", "title": "Barracuda ESG / UNC4841", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:barracuda.com:1bcc6b40b018f4b3", "title": "Barracuda ESG CVE-2023–2868 advisory", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.barracuda.com/company/legal/esg-vulnerability", "publisher": "Barracuda", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "barracuda.com", "key": "publisher-domain:barracuda.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:docusaurus.io:21c786d5a591e36e", "title": "baseUrl configuration", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docusaurus.io/docs/docusaurus.config.js", "publisher": "Docusaurus", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docusaurus.io", "key": "publisher-domain:docusaurus.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "CTI-to-detection workbench for teams that need evidence, not guesswork", "url": "https://1200km.com/adversarygraph-docs/", "type": "documentation", "domain": "platform-documentation" }, { "title": "ITDR", "url": "https://1200km.com/ITDR/", "type": "research", "domain": "identity-security" } ] }, { "id": "site-reference:github.com:518c562180474eea", "title": "Basic_inf_gathering.py", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/Basic-File-Information-Gathering-Script/tree/main", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Static Malware Analysis. File Fingerprinting", "url": "https://1200km.com/articles/read/2025/2025-04-01-static-malware-analysis-file-fingerprinting-3ddf9bdd7864/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:bazaar.abuse.ch:3aad9b4eadb85fff", "title": "bazaar.abuse.ch", "description": "External source cited by 1 maintained 1200km page.", "url": "https://bazaar.abuse.ch/sample/5d1e3b113e15fc5fd4a08f41e553b8fd0eaace74b6dc034e0f6237c5e10aa737", "publisher": "Bazaar Abuse", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "bazaar.abuse.ch", "key": "publisher-domain:bazaar.abuse.ch" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:arxiv.org:edf4d4e341f9f6ae", "title": "Biggio et al. — Evasion Attacks against Machine Learning at Test Time", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1708.06131", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:binarly.io:9a61f42bf20b82fb", "title": "Binarly Bootkitty / LogoFAIL exploitation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.binarly.io/blog/logofail-exploited-deploy-bootkitty-first-uefi-bootkit-linux", "publisher": "Binarly", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "binarly.io", "key": "publisher-domain:binarly.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:binarly.io:d9a38a9e9493ae60", "title": "Binarly LogoFAIL report hub", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.binarly.io/reports/logofail", "publisher": "Binarly", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "binarly.io", "key": "publisher-domain:binarly.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:bitdefender.com:3aad49ccdbee1760", "title": "bitdefender.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.bitdefender.com/en-us/blog/hotforsecurity/gtp-protocol-vulnerabilities-directly-affect-5g-mobile-operators-users", "publisher": "Bitdefender", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "bitdefender.com", "key": "publisher-domain:bitdefender.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:bitdefender.com:beef0645a2769f6c", "title": "bitdefender.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.bitdefender.com/en-us/blog/hotforsecurity/the-phishing-swindle-that-conned-100-million-out-of-google-and-facebook", "publisher": "Bitdefender", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "bitdefender.com", "key": "publisher-domain:bitdefender.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:blackfog.com:f257a9e2892f27dc", "title": "blackfog.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.blackfog.com/aws-data-breach", "publisher": "Blackfog", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blackfog.com", "key": "publisher-domain:blackfog.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:blog.appsecco.com:fc4c4bacd640b5d4", "title": "blog.appsecco.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.appsecco.com/an-ssrf-privileged-aws-keys-and-the-capital-one-breach-4c3c2cded3af", "publisher": "BLOG Appsecco", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.appsecco.com", "key": "publisher-domain:blog.appsecco.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:blog.ecapuano.com:a29bbc44024a1730", "title": "blog.ecapuano.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.ecapuano.com/p/atomic-and-stateful-detection-rules", "publisher": "BLOG Ecapuano", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.ecapuano.com", "key": "publisher-domain:blog.ecapuano.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:blog.sigmahq.io:4a6dd8e5adecc770", "title": "blog.sigmahq.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.sigmahq.io/introducing-sigma-correlations-52fe377f2527?gi=053b87e3d665", "publisher": "BLOG Sigmahq", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.sigmahq.io", "key": "publisher-domain:blog.sigmahq.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:blog.talosintelligence.com:e71bb9c8cda81205", "title": "blog.talosintelligence.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.talosintelligence.com/talos-ir-quarterly-report-q4-2023", "publisher": "BLOG Talosintelligence", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.talosintelligence.com", "key": "publisher-domain:blog.talosintelligence.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:blogs.stickmancyber.com:abed1a4199942a24", "title": "blogs.stickmancyber.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blogs.stickmancyber.com/cybersecurity-blog/why-cybersecurity-in-the-workplace-is-everyones-responsibility", "publisher": "Blogs Stickmancyber", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blogs.stickmancyber.com", "key": "publisher-domain:blogs.stickmancyber.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:bloomberg.com:e59e00ff8bd5f97a", "title": "bloomberg.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.bloomberg.com/news/articles/2021-06-04/hackers-breached-colonial-pipeline-using-compromised-password", "publisher": "Bloomberg", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "bloomberg.com", "key": "publisher-domain:bloomberg.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "ai-attack-reference:pub-038", "title": "BlueNoroff’s latest campaigns: GhostCall and GhostHire | Securelist", "description": "Kaspersky GReAT operational CTI publication covering CAPTCHA bypass, Deepfake video or image, and Identity fraud and impersonation. Indexed with APT43 / Kimsuky, Cryptocurrency, and OpenAI context.", "url": "https://securelist.com/bluenoroff-apt-campaigns-ghostcall-and-ghosthire/117842/", "publisher": "Kaspersky GReAT", "published_at": "2025-10-28", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Disruption / destruction", "key": "actor-motivation:disruption-/-destruction" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Campaign", "type": "campaign", "value": "GhostCall", "key": "campaign:ghostcall" }, { "facet": "Campaign", "type": "campaign", "value": "GhostHire", "key": "campaign:ghosthire" }, { "facet": "Campaign", "type": "campaign", "value": "Operation SyncHole", "key": "campaign:operation-synchole" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Campaign Or Intrusion Duration", "type": "metric", "value": "2025 minute · medium confidence", "key": "metric:2025-minute-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "30 seconds · medium confidence", "key": "metric:30-seconds-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "alwayswait[.]site", "key": "ioc:alwayswait-.-site" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "autoupdate[.]online", "key": "ioc:autoupdate-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "autoupdate[.]xyz", "key": "ioc:autoupdate-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "awaitingfor[.]online", "key": "ioc:awaitingfor-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "awaitingfor[.]site", "key": "ioc:awaitingfor-.-site" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "bots[.]autoupdate[.]online", "key": "ioc:bots-.-autoupdate-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "chkactive[.]online", "key": "ioc:chkactive-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "chkstate[.]online", "key": "ioc:chkstate-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "commoncome[.]online", "key": "ioc:commoncome-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "datatabletemplate[.]xyz", "key": "ioc:datatabletemplate-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "filedrive[.]online", "key": "ioc:filedrive-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "firstfromsep[.]online", "key": "ioc:firstfromsep-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "image-support[.]xyz", "key": "ioc:image-support-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "instant-update[.]online", "key": "ioc:instant-update-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "longlastfor[.]online", "key": "ioc:longlastfor-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "readysafe[.]xyz", "key": "ioc:readysafe-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "real-update[.]xyz", "key": "ioc:real-update-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "safefor[.]xyz", "key": "ioc:safefor-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "safeupload[.]online", "key": "ioc:safeupload-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "secondshop[.]online", "key": "ioc:secondshop-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security-update[.]xyz", "key": "ioc:security-update-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "signsafe[.]site", "key": "ioc:signsafe-.-site" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "signsafe[.]xyz", "key": "ioc:signsafe-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "system-update[.]xyz", "key": "ioc:system-update-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "video-meeting[.]online", "key": "ioc:video-meeting-.-online" }, { "facet": "IOC · Md5", "type": "ioc", "value": "00dd47af3db45548d2722fe8a4489508", "key": "ioc:00dd47af3db45548d2722fe8a4489508" }, { "facet": "IOC · Md5", "type": "ioc", "value": "01d3ed1c228f09d8e56bfbc5f5622a6c", "key": "ioc:01d3ed1c228f09d8e56bfbc5f5622a6c" }, { "facet": "IOC · Md5", "type": "ioc", "value": "0af11f610da1f691e43173d44643283f", "key": "ioc:0af11f610da1f691e43173d44643283f" }, { "facet": "IOC · Md5", "type": "ioc", "value": "0ca37675d75af0e7def0025cd564d6c5", "key": "ioc:0ca37675d75af0e7def0025cd564d6c5" }, { "facet": "IOC · Md5", "type": "ioc", "value": "10cd1ef394bc2a2d8d8f2558b73ac7b8", "key": "ioc:10cd1ef394bc2a2d8d8f2558b73ac7b8" }, { "facet": "IOC · Md5", "type": "ioc", "value": "1243968876262c3ad4250e1371447b23", "key": "ioc:1243968876262c3ad4250e1371447b23" }, { "facet": "IOC · Md5", "type": "ioc", "value": "1653d75d579872fadec1f22cf7fee3c0", "key": "ioc:1653d75d579872fadec1f22cf7fee3c0" }, { "facet": "IOC · Md5", "type": "ioc", "value": "17baae144d383e4dc32f1bf69700e587", "key": "ioc:17baae144d383e4dc32f1bf69700e587" }, { "facet": "IOC · Md5", "type": "ioc", "value": "19a7e16332a6860b65e6944f1f3c5001", "key": "ioc:19a7e16332a6860b65e6944f1f3c5001" }, { "facet": "IOC · Md5", "type": "ioc", "value": "1ee10fa01587cec51f455ceec779a160", "key": "ioc:1ee10fa01587cec51f455ceec779a160" }, { "facet": "IOC · Md5", "type": "ioc", "value": "261a409946b6b4d9ce706242a76134e3", "key": "ioc:261a409946b6b4d9ce706242a76134e3" }, { "facet": "IOC · Md5", "type": "ioc", "value": "2b499eb3865a7ef17264d15252b7f73e", "key": "ioc:2b499eb3865a7ef17264d15252b7f73e" }, { "facet": "IOC · Md5", "type": "ioc", "value": "2c42253ebf9a743814b9b16a89522bef", "key": "ioc:2c42253ebf9a743814b9b16a89522bef" }, { "facet": "IOC · Md5", "type": "ioc", "value": "31b88dd319af8e4b8a96fc9732ebc708", "key": "ioc:31b88dd319af8e4b8a96fc9732ebc708" }, { "facet": "IOC · Md5", "type": "ioc", "value": "358c2969041c8be74ce478edb2ffcd19", "key": "ioc:358c2969041c8be74ce478edb2ffcd19" }, { "facet": "IOC · Md5", "type": "ioc", "value": "389447013870120775556bb4519dba97", "key": "ioc:389447013870120775556bb4519dba97" }, { "facet": "IOC · Md5", "type": "ioc", "value": "38c8d80dd32d00e9c9440a498f7dd739", "key": "ioc:38c8d80dd32d00e9c9440a498f7dd739" }, { "facet": "IOC · Md5", "type": "ioc", "value": "3bbe4dfe3134c8a7928d10c948e20bee", "key": "ioc:3bbe4dfe3134c8a7928d10c948e20bee" }, { "facet": "IOC · Md5", "type": "ioc", "value": "50f341b24cb75f37d042d1e5f9e3e5aa", "key": "ioc:50f341b24cb75f37d042d1e5f9e3e5aa" }, { "facet": "IOC · Md5", "type": "ioc", "value": "529fe6eff1cf452680976087e2250c02", "key": "ioc:529fe6eff1cf452680976087e2250c02" }, { "facet": "IOC · Md5", "type": "ioc", "value": "5ad40a5fd18a1b57b69c44bc2963dc6b", "key": "ioc:5ad40a5fd18a1b57b69c44bc2963dc6b" }, { "facet": "IOC · Md5", "type": "ioc", "value": "5cb4f0084f3c25e640952753ed5b25d0", "key": "ioc:5cb4f0084f3c25e640952753ed5b25d0" }, { "facet": "IOC · Md5", "type": "ioc", "value": "60bfe4f378e9f5a84183ac505a032228", "key": "ioc:60bfe4f378e9f5a84183ac505a032228" }, { "facet": "IOC · Md5", "type": "ioc", "value": "6348b49f3499d760797247b94385fda3", "key": "ioc:6348b49f3499d760797247b94385fda3" }, { "facet": "IOC · Md5", "type": "ioc", "value": "6422795a6df10c45c1006f92d686ee7e", "key": "ioc:6422795a6df10c45c1006f92d686ee7e" }, { "facet": "IOC · Md5", "type": "ioc", "value": "6aa93664b4852cb5bad84ba1a187f645", "key": "ioc:6aa93664b4852cb5bad84ba1a187f645" }, { "facet": "IOC · Md5", "type": "ioc", "value": "7168ce5c6e5545a5b389db09c90038da", "key": "ioc:7168ce5c6e5545a5b389db09c90038da" }, { "facet": "IOC · Md5", "type": "ioc", "value": "73d26eb56e5a3426884733c104c3f625", "key": "ioc:73d26eb56e5a3426884733c104c3f625" }, { "facet": "IOC · Md5", "type": "ioc", "value": "7581854ff6c890684823f3aed03c210f", "key": "ioc:7581854ff6c890684823f3aed03c210f" }, { "facet": "IOC · Md5", "type": "ioc", "value": "76ace3a6892c25512b17ed42ac2ebd05", "key": "ioc:76ace3a6892c25512b17ed42ac2ebd05" }, { "facet": "IOC · Md5", "type": "ioc", "value": "7e50c3f301dd045eb189ba1644ded155", "key": "ioc:7e50c3f301dd045eb189ba1644ded155" }, { "facet": "IOC · Md5", "type": "ioc", "value": "7f94ed2d5f566c12de5ebe4b5e3d8aa3", "key": "ioc:7f94ed2d5f566c12de5ebe4b5e3d8aa3" }, { "facet": "IOC · Md5", "type": "ioc", "value": "8006efb8dd703073197e5a27682b35bf", "key": "ioc:8006efb8dd703073197e5a27682b35bf" }, { "facet": "IOC · Md5", "type": "ioc", "value": "8f8942cd14f646f59729f83cbd4c357b", "key": "ioc:8f8942cd14f646f59729f83cbd4c357b" }, { "facet": "IOC · Md5", "type": "ioc", "value": "931cec3c80c78d233e3602a042a2e71b", "key": "ioc:931cec3c80c78d233e3602a042a2e71b" }, { "facet": "IOC · Md5", "type": "ioc", "value": "9551b4af789b2db563f9452eaf46b6aa", "key": "ioc:9551b4af789b2db563f9452eaf46b6aa" }, { "facet": "IOC · Md5", "type": "ioc", "value": "963f473f1734d8b3fbb8c9a227c06d07", "key": "ioc:963f473f1734d8b3fbb8c9a227c06d07" }, { "facet": "IOC · Md5", "type": "ioc", "value": "a070b77c5028d7a5d2895f1c9d35016f", "key": "ioc:a070b77c5028d7a5d2895f1c9d35016f" }, { "facet": "IOC · Md5", "type": "ioc", "value": "a0eb7e480752d494709c63aa35ccf36c", "key": "ioc:a0eb7e480752d494709c63aa35ccf36c" }, { "facet": "IOC · Md5", "type": "ioc", "value": "a26f2b97ca4e2b4b5d58933900f02131", "key": "ioc:a26f2b97ca4e2b4b5d58933900f02131" }, { "facet": "IOC · Md5", "type": "ioc", "value": "a6ce961f487b4cbdfe68d0a249647c48", "key": "ioc:a6ce961f487b4cbdfe68d0a249647c48" }, { "facet": "IOC · Md5", "type": "ioc", "value": "ab1e8693931f8c694247d96cf5a85197", "key": "ioc:ab1e8693931f8c694247d96cf5a85197" }, { "facet": "IOC · Md5", "type": "ioc", "value": "b2e9a6412fd7c068a5d7c38d0afd946f", "key": "ioc:b2e9a6412fd7c068a5d7c38d0afd946f" }, { "facet": "IOC · Md5", "type": "ioc", "value": "b567bfdaac131a2d8a23ad8fd450a31d", "key": "ioc:b567bfdaac131a2d8a23ad8fd450a31d" }, { "facet": "IOC · Md5", "type": "ioc", "value": "c42c7a2ea1c2f00dddb0cc4c8bfb5bcf", "key": "ioc:c42c7a2ea1c2f00dddb0cc4c8bfb5bcf" }, { "facet": "IOC · Md5", "type": "ioc", "value": "c446682f33641cff21083ac2ce477dbe", "key": "ioc:c446682f33641cff21083ac2ce477dbe" }, { "facet": "IOC · Md5", "type": "ioc", "value": "c6f0c8d41b9ad4f079161548d2435d80", "key": "ioc:c6f0c8d41b9ad4f079161548d2435d80" }, { "facet": "IOC · Md5", "type": "ioc", "value": "d63805e89053716b6ab93ce6decf8450", "key": "ioc:d63805e89053716b6ab93ce6decf8450" }, { "facet": "IOC · Md5", "type": "ioc", "value": "d8529855fab4b4aa6c2b34449cb3b9fb", "key": "ioc:d8529855fab4b4aa6c2b34449cb3b9fb" }, { "facet": "IOC · Md5", "type": "ioc", "value": "de93e85199240de761a8ba0a56f0088d", "key": "ioc:de93e85199240de761a8ba0a56f0088d" }, { "facet": "IOC · Md5", "type": "ioc", "value": "e33f942cf1479ca8530a916868bad954", "key": "ioc:e33f942cf1479ca8530a916868bad954" }, { "facet": "IOC · Md5", "type": "ioc", "value": "e8680d17fba6425e4a9bb552fb8db2b1", "key": "ioc:e8680d17fba6425e4a9bb552fb8db2b1" }, { "facet": "IOC · Md5", "type": "ioc", "value": "e9fdd703e60b31eb803b1b59985cabec", "key": "ioc:e9fdd703e60b31eb803b1b59985cabec" }, { "facet": "IOC · Md5", "type": "ioc", "value": "eda0525c078f5a216a977bc64e86160a", "key": "ioc:eda0525c078f5a216a977bc64e86160a" }, { "facet": "IOC · Md5", "type": "ioc", "value": "f1bad0efbd3bd5a4202fe740756f977a", "key": "ioc:f1bad0efbd3bd5a4202fe740756f977a" }, { "facet": "IOC · Md5", "type": "ioc", "value": "f1d2af27b13cd3424556b18dfd3cf83f", "key": "ioc:f1d2af27b13cd3424556b18dfd3cf83f" }, { "facet": "IOC · Md5", "type": "ioc", "value": "f8bb2528bf35f8c11fbc4369e68c4038", "key": "ioc:f8bb2528bf35f8c11fbc4369e68c4038" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "3dd226d0b700f33974f409142defb62a8cd172ae5f2eb9beb7f5750eb1702e2a", "key": "ioc:3dd226d0b700f33974f409142defb62a8cd172ae5f2eb9beb7f5750eb1702e2a" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "4451ee8bc53ea7c148d8348bc7b82aca9977bdd31c0156dfe25c4a879a1d2190", "key": "ioc:4451ee8bc53ea7c148d8348bc7b82aca9977bdd31c0156dfe25c4a879a1d2190" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "5b77f83ecefa0e32ba922f61c9efff7f755ba51a010db844ca7e8ad3db28650a", "key": "ioc:5b77f83ecefa0e32ba922f61c9efff7f755ba51a010db844ca7e8ad3db28650a" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "71b743c529f0b27735f7774a0903cb908edc93423b60fe9be49a3729982d0e8d", "key": "ioc:71b743c529f0b27735f7774a0903cb908edc93423b60fe9be49a3729982d0e8d" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "a6c1a7ce43b029a1ef4ae69b26f745440ecce8368c89f11ac999d4ed04a31572", "key": "ioc:a6c1a7ce43b029a1ef4ae69b26f745440ecce8368c89f11ac999d4ed04a31572" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b3cc15c1033de79024f9cf3cd6a6a7a9b7e54a1a57d3156036f5c05f541694b7", "key": "ioc:b3cc15c1033de79024f9cf3cd6a6a7a9b7e54a1a57d3156036f5c05f541694b7" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b494a0ae421afe170f6cb9de2c1193a78fbe16f627f85139676afc5d9bfe93a2", "key": "ioc:b494a0ae421afe170f6cb9de2c1193a78fbe16f627f85139676afc5d9bfe93a2" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c4db903322d17c8cbf1d1db55124854c0b070d6ece54162b6a4d06df24c572df", "key": "ioc:c4db903322d17c8cbf1d1db55124854c0b070d6ece54162b6a4d06df24c572df" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "CoolClient backdoor", "key": "malware-or-tool:coolclient-backdoor" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "DownTroy malware", "key": "malware-or-tool:downtroy-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "KANDYKORN malware", "key": "malware-or-tool:kandykorn-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "KONNI malware", "key": "malware-or-tool:konni-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "NightLedger backdoor", "key": "malware-or-tool:nightledger-backdoor" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "ObjCShellZ malware", "key": "malware-or-tool:objcshellz-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "RooTroy backdoor", "key": "malware-or-tool:rootroy-backdoor" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "RustBucket malware", "key": "malware-or-tool:rustbucket-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "SugarLoader malware", "key": "malware-or-tool:sugarloader-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "SysPhon malware", "key": "malware-or-tool:sysphon-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "SysPhone backdoor", "key": "malware-or-tool:sysphone-backdoor" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "TeamsClutch malware", "key": "malware-or-tool:teamsclutch-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "TripleWatch stealer", "key": "malware-or-tool:triplewatch-stealer" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Kaspersky GReAT", "key": "publisher:kaspersky-great" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "securelist.com", "key": "publisher-domain:securelist.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT43 / Kimsuky", "key": "threat-group:apt43-/-kimsuky" }, { "facet": "Threat group", "type": "threat_group", "value": "BlueNoroff", "key": "threat-group:bluenoroff" }, { "facet": "Threat group", "type": "threat_group", "value": "Lazarus Group", "key": "threat-group:lazarus-group" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT38", "key": "threat-group-identifier:apt38" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA444", "key": "threat-group-identifier:ta444" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC1549", "key": "threat-group-identifier:unc1549" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Fake website or service", "key": "ttp:fake-website-or-service" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:cisa.gov:9bb054299d8cb094", "title": "BOD 26–02, Mitigating Risk From End-of-Support Edge Devices (canonical directive page)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:arxiv.org:afb76917d8ade805", "title": "Bommasani et al.: On the Opportunities and Risks of Foundation Models", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/2108.07258", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:brandefense.io:0fca2ddce665c5c9", "title": "Brandefense — MuddyWater PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://brandefense.io/wp-content/uploads/2025/10/brandefense.io-muddywater-iran-linked-espionage-group-expanding-global-reach-muddywater-.pdf", "publisher": "Brandefense", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "brandefense.io", "key": "publisher-domain:brandefense.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:mandiant.com:47b9034d10ea3427", "title": "Breach recovery statistics", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.mandiant.com/resources/report/m-trends-2024", "publisher": "Mandiant", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mandiant.com", "key": "publisher-domain:mandiant.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:brew.sh:f541b494a195eeec", "title": "brew.sh", "description": "External source cited by 1 maintained 1200km page.", "url": "https://brew.sh", "publisher": "BREW", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "brew.sh", "key": "publisher-domain:brew.sh" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1", "url": "https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-036", "title": "Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - Check Point Research", "description": "Check Point provider or government report covering Malware development, Translation and localization, and Credential theft. Indexed with Financial Services and Anthropic context.", "url": "https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-technique/", "publisher": "Check Point", "published_at": "2026-07-01", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5", "key": "ioc:07c39f79ab92fb21557b82283472dce1c112f577d796111fb752c3c6d84c86b5" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "DeepSeek", "key": "llm-model:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "DeepSeek", "key": "llm-provider:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Check Point", "key": "publisher:check-point" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:builtwith.com:1c15cf22d38f8ef1", "title": "BuiltWith", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://builtwith.com", "publisher": "Builtwith", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "builtwith.com", "key": "publisher-domain:builtwith.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" }, { "title": "Web Applications Penetretion Testing. Stage 1: Reconnaissance", "url": "https://1200km.com/articles/read/2024/2024-11-10-web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:activeresponse.org:8dc24b967afbf078", "title": "Caltagirone, Pendergast, and Betz, The Diamond Model of Intrusion Analysis", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf", "publisher": "Activeresponse", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "activeresponse.org", "key": "publisher-domain:activeresponse.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:capstone-engine.org:c79a624c97c535d6", "title": "Capstone Engine documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.capstone-engine.org/documentation.html", "publisher": "Capstone Engine", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "capstone-engine.org", "key": "publisher-domain:capstone-engine.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:car.mitre.org:5ace3a77d8ad1367", "title": "car.mitre.org", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://car.mitre.org", "publisher": "CAR Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "car.mitre.org", "key": "publisher-domain:car.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:arxiv.org:b187c740d23d1533", "title": "Carlini and Wagner — On Evaluating Adversarial Robustness", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1902.06705", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:arxiv.org:6df025b925a0362c", "title": "Carlini et al. — Poisoning Web-Scale Training Datasets Is Practical", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/2302.10149", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:78d3528a9d48657f", "title": "cd81ef242db0bcea3296970d45c241a4228d2d27", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/AIDebug/commit/cd81ef242db0bcea3296970d45c241a4228d2d27", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:docs.censys.com:df0b9eb36d70841e", "title": "Censys Platform documentation", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.censys.com/docs/platform-quickstart-guide", "publisher": "DOCS Censys", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.censys.com", "key": "publisher-domain:docs.censys.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:ctid.mitre.org:550ba4a9de83aed1", "title": "Center for Threat-Informed Defense, Summiting the Pyramid: Bring the Pain with Robust and Accurate Detection (December 16, 2024)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ctid.mitre.org/blog/2024/12/16/summiting-the-pyramid-bring-the-pain", "publisher": "CTID Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ctid.mitre.org", "key": "publisher-domain:ctid.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:center-for-threat-informed-defense.github.io:861f277bbf2496bc", "title": "center-for-threat-informed-defense.github.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://center-for-threat-informed-defense.github.io/mappings-explorer/attack/attack-14.1/domain-enterprise/techniques/T1498.001", "publisher": "Center FOR Threat Informed Defense Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "center-for-threat-informed-defense.github.io", "key": "publisher-domain:center-for-threat-informed-defense.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "ai-attack-reference:pub-009", "title": "CERT-EU - Threat Landscape Report 2025 - A Year In Review", "description": "CERT-EU government or law-enforcement publication covering Deepfake video or image, Voice phishing / vishing, and Deepfake / synthetic media.", "url": "https://cert.europa.eu/publications/threat-intelligence/tlr2025/", "publisher": "CERT-EU", "published_at": "2025", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "38% · medium confidence", "key": "metric:38-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "60% · medium confidence", "key": "metric:60-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "80% · medium confidence", "key": "metric:80-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Url Year Only", "key": "publication-date-method:url-year-only" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Year", "key": "publication-date-precision:year" }, { "facet": "Publisher", "type": "publisher", "value": "CERT-EU", "key": "publisher:cert-eu" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cert.europa.eu", "key": "publisher-domain:cert.europa.eu" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "official advisory, fraud alert, or regional threat report", "key": "relevance-basis:official-advisory-fraud-alert-or-regional-threat-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "government or law-enforcement publication", "key": "source-type:government-or-law-enforcement-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_incident", "key": "statistical-use:context-or-incident" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:kb.cert.org:f73c3c041b23abc5", "title": "CERT/CC PixieFail VU#132380", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.kb.cert.org/vuls/id/132380", "publisher": "KB CERT", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kb.cert.org", "key": "publisher-domain:kb.cert.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:kb.cert.org:dd5fd286935b6c69", "title": "CERT/CC VU#489481 — Cylance Antivirus Products Susceptible to Concatenation Bypass", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.kb.cert.org/vuls/id/489481", "publisher": "KB CERT", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kb.cert.org", "key": "publisher-domain:kb.cert.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:radar.certfa.com:ec6a9498bf1b312a", "title": "CERTFA Radar — MuddyWater / Earth Vetala Intrusion", "description": "External source cited by 1 maintained 1200km page.", "url": "https://radar.certfa.com/en/threats/view/d7c9c420", "publisher": "Radar Certfa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "radar.certfa.com", "key": "publisher-domain:radar.certfa.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:radar.certfa.com:a8c05bdfc343756f", "title": "CERTFA Radar — MuddyWater Threat Actor Cluster", "description": "External source cited by 1 maintained 1200km page.", "url": "https://radar.certfa.com/en/insights/cluster/fe272810", "publisher": "Radar Certfa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "radar.certfa.com", "key": "publisher-domain:radar.certfa.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:specterops.io:9e7be9299a7af3c6", "title": "Certified Pre-Owned Research", "description": "External source cited by 1 maintained 1200km page.", "url": "https://specterops.io/assets/resources/Certified_Pre-Owned.pdf", "publisher": "Specterops", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "specterops.io", "key": "publisher-domain:specterops.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Cursor + Hexstrike. Fully Automated ADCS ESC8 Attack", "url": "https://1200km.com/articles/read/2026/2026-01-29-cursor-hexstrike-fully-automated-adcs-esc8-attack-8736fec53c58/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:huggingface.co:afabca265499760b", "title": "Chat templates", "description": "External source cited by 1 maintained 1200km page.", "url": "https://huggingface.co/docs/transformers/main/chat_templating", "publisher": "Huggingface", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "huggingface.co", "key": "publisher-domain:huggingface.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:huggingface.co:14ad11e769d413d1", "title": "Chat templates", "description": "External source cited by 1 maintained 1200km page.", "url": "https://huggingface.co/docs/transformers/v5.15.1/chat_templating", "publisher": "Huggingface", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "huggingface.co", "key": "publisher-domain:huggingface.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "ai-attack-reference:pub-037", "title": "ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime - Check Point Research", "description": "Check Point provider or government report covering Data exfiltration. Indexed with OpenAI context.", "url": "https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/", "publisher": "Check Point", "published_at": "2026-03-30", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Check Point", "key": "publisher:check-point" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:blog.checkpoint.com:73d8ee036f6e9758", "title": "Check Point — MuddyWater Threat Group Deploys New BugSleep Backdoor", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.checkpoint.com/research/muddywater-threat-group-deploys-new-bugsleep-backdoor", "publisher": "BLOG Checkpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.checkpoint.com", "key": "publisher-domain:blog.checkpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:checkpoint.com:148b2e7c55519401", "title": "Check Point Security Report 2024", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cyber-attack/security-report", "publisher": "Checkpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "checkpoint.com", "key": "publisher-domain:checkpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:checkmarx.com:f49c00bc0994b4bc", "title": "checkmarx.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://checkmarx.com/learn/container-security/docker-container-security-best-practices-image-scanning-is-non-negotiable", "publisher": "Checkmarx", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "checkmarx.com", "key": "publisher-domain:checkmarx.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:arxiv.org:07488992b4fa0c91", "title": "Chen et al. — Detecting Backdoor Attacks through Activation Clustering", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1811.03728", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "ai-attack-reference:pub-044", "title": "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks", "description": "Palo Alto Networks Unit 42 operational CTI publication covering Autonomous or agentic intrusion, CAPTCHA bypass, and Exploit development. Indexed with Government and Anthropic context.", "url": "https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/", "publisher": "Palo Alto Networks Unit 42", "published_at": "2026-07-30", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Autonomous or agentic intrusion", "key": "ai-use-case:autonomous-or-agentic-intrusion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Hermes Agent", "key": "campaign:operation-hermes-agent" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-33538", "key": "cve:cve-2023-33538" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-0921", "key": "cve:cve-2025-0921" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-40947", "key": "cve:cve-2025-40947" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-40948", "key": "cve:cve-2025-40948" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-68613", "key": "cve:cve-2025-68613" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-0257", "key": "cve:cve-2026-0257" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-0300", "key": "cve:cve-2026-0300" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-1281", "key": "cve:cve-2026-1281" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-1340", "key": "cve:cve-2026-1340" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-1731", "key": "cve:cve-2026-1731" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-21858", "key": "cve:cve-2026-21858" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-3055", "key": "cve:cve-2026-3055" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-31431", "key": "cve:cve-2026-31431" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-33017", "key": "cve:cve-2026-33017" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-33824", "key": "cve:cve-2026-33824" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-34486", "key": "cve:cve-2026-34486" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-39987", "key": "cve:cve-2026-39987" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "100 systems · medium confidence", "key": "metric:100-systems-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "over 460 targets · medium confidence", "key": "metric:over-460-targets-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "aliyuncs[.]com", "key": "ioc:aliyuncs-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "deepseek[.]com", "key": "ioc:deepseek-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "newcli[.]com", "key": "ioc:newcli-.-com" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "DeepSeek", "key": "llm-model:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "DeepSeek", "key": "llm-provider:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Palo Alto Networks Unit 42", "key": "publisher:palo-alto-networks-unit-42" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Target", "type": "target", "value": "Security researchers", "key": "target:security-researchers" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:cia.gov:f2aa3b7a8386a4d8", "title": "CIA CSI, 2007 NIE on Iran", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cia.gov/resources/csi/books-monographs/cia-support-to-policymakers-the-2007-nie-on-irans-nuclear-intentions-and-capabilities", "publisher": "CIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cia.gov", "key": "publisher-domain:cia.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cia.gov:86abcc0b80a90908", "title": "CIA, A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cia.gov/resources/csi/static/Tradecraft-Primer-apr09.pdf", "publisher": "CIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cia.gov", "key": "publisher-domain:cia.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cia.gov:f7537d407df44bc6", "title": "CIA, Sherman Kent and the Profession of Intelligence Analysis", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cia.gov/resources/csi/static/Kent-Profession-Intel-Analysis.pdf", "publisher": "CIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cia.gov", "key": "publisher-domain:cia.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cia.gov:e9ed0387bc574f22", "title": "CIA, Sherman Kent, Words of Estimative Probability", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cia.gov/resources/csi/studies-in-intelligence/archives/vol-8-no-4/words-of-estimative-probability", "publisher": "CIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cia.gov", "key": "publisher-domain:cia.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cia.gov:a874002285dd58c5", "title": "CIA, The Intelligence Process: A Digest from Strategic Intelligence", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cia.gov/readingroom/document/cia-rdp78-04718a000600100003-3", "publisher": "CIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cia.gov", "key": "publisher-domain:cia.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cisecurity.org:52963ab5b9b81184", "title": "CIS Controls v8.1", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisecurity.org/controls/v8-1", "publisher": "Cisecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisecurity.org", "key": "publisher-domain:cisecurity.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:cisecurity.org:2c87efdfb87b5131", "title": "CIS Google Kubernetes Engine (GKE) Benchmark v1.5.0 | CIS", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisecurity.org/benchmark/kubernetes", "publisher": "Cisecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisecurity.org", "key": "publisher-domain:cisecurity.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Building a Vulnerable Kubernetes Lab: A Complete Guide to 25 Critical Security Issues", "url": "https://1200km.com/articles/read/2026/2026-02-02-building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91/", "type": "article", "domain": "cloud-security" }, { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cisa.gov:ef58da19fc9c4984", "title": "CISA — AA23–335A PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/sites/default/files/2023-12/aa23-335a-irgc-affiliated-cyber-actors-exploit-plcs-in-multiple-sectors-1.pdf", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cisa.gov:e34469764338ff7b", "title": "CISA — AA23–335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cisa.gov:c790657be391204e", "title": "CISA — Iran state-sponsored cyber threat publications", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyber-actors/iran/publications", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cisa.gov:ff589723036dcc18", "title": "CISA — Iran Threat Overview and Advisories", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" }, { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cisa.gov:d559ad400d051839", "title": "CISA / FBI / CNMF / NCSC-UK / NSA — AA22–055A advisory page", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" }, { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cisa.gov:9383c998b028e48d", "title": "CISA / FBI / CNMF / NCSC-UK / NSA — AA22–055A PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/sites/default/files/publications/AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations.pdf", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cisa.gov:f9118fc36cfcc695", "title": "CISA Advisory AA23–144A (May 2023)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "Manual CTI vs. AI-Assisted CTI: A Step-by-Step Clock Comparison", "url": "https://1200km.com/articles/read/2026/2026-05-08-manual-cti-vs-ai-assisted-cti-a-step-by-step-clock-comparison-ee08325203fc/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:cisa.gov:9197d110f1324dd6", "title": "CISA alert — Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/alerts/2022/02/24/iranian-government-sponsored-muddywater-actors-conducting-malicious", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cisa.gov:a969f8830387924c", "title": "CISA Automated Indicator Sharing / AIS", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/resources-tools/services/automated-indicator-sharing-ais-service", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cisa.gov:85332d72c81836d1", "title": "CISA BOD 23-01 — Asset Visibility and Vulnerability Detection", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:cisa.gov:5bec1392b066ae97", "title": "CISA Cybersecurity Alerts and Advisories", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:cisa.gov:5ff69dbd5d93fea3", "title": "CISA enhanced analysis PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cisa.gov:afb2928429033bb3", "title": "CISA Incident and Vulnerability Response Playbooks", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisa.gov/topics/cybersecurity-best-practices/executive-order-improving-nations-cybersecurity", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:cisa.gov:16519bf46eaff909", "title": "CISA KEV API (JSON feed)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:cisa.gov:18d4ac8f8ecac5a7", "title": "CISA Known Exploited Vulnerabilities (KEV) Catalog", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" }, { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:cisa.gov:e68cd15dacb73868", "title": "CISA logging guidance", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/use-logging-on-business-systems", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:cisa.gov:916accae8f822213", "title": "CISA, Cross-Sector CPGs FAQ", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/cross-sector-cybersecurity-performance-goals/frequently-asked-questions", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cisa.gov:06ece712b67853aa", "title": "CISA, Cross-Sector Cybersecurity Performance Goals", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/cybersecurity-performance-goals", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cisa.gov:6ced40bc45acead2", "title": "CISA, Enhanced Visibility and Hardening Guidance for Communications Infrastructure", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cisa.gov:9899a5842019425c", "title": "CISA, Iran-based cyber actors enabling ransomware attacks", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cisa.gov:9928b55683b35064", "title": "CISA, IRGC-affiliated CyberAv3ngers advisory", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/sites/default/files/2024-12/aa23-335a-irgc-affiliated-cyber-actors-exploit-plcs-in-multiple-sectors.pdf", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cisa.gov:c94883f388f13065", "title": "cisa.gov", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:cisa.gov:42c69f2fdff01815", "title": "cisa.gov/news-events/cybersecurity-advisories/aa21–008a", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-008a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Attribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution", "url": "https://1200km.com/articles/read/2026/2026-03-20-attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cisa.gov:b089b388e066d97b", "title": "CISA/FBI Product Security Bad Practices", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisa.gov/news-events/alerts/2025/01/17/cisa-and-fbi-release-updated-guidance-product-security-bad-practices", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" } ] }, { "id": "site-reference:cisa.gov:fb637bf4f0fda43f", "title": "CISA/NCSC Guidelines for Secure AI System Development", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisa.gov/news-events/alerts/2023/11/26/cisa-and-uk-ncsc-unveil-joint-guidelines-secure-ai-system-development", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:sec.cloudapps.cisco.com:f27edf2c09f5986e", "title": "Cisco IOS XE CVE-2023–20198 + CVE-2023–20273 .", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "publisher": "SEC Cloudapps Cisco", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sec.cloudapps.cisco.com", "key": "publisher-domain:sec.cloudapps.cisco.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:sec.cloudapps.cisco.com:3f65f25b61b391c1", "title": "Cisco Security Advisories portal", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sec.cloudapps.cisco.com/security/center/publicationListing.x", "publisher": "SEC Cloudapps Cisco", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sec.cloudapps.cisco.com", "key": "publisher-domain:sec.cloudapps.cisco.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "ai-attack-reference:pub-005", "title": "Cisco Talos 2024 Year in Review", "description": "Cisco Talos operational CTI publication covering CAPTCHA bypass, Code debugging and scripting, and Deepfake video or image. Indexed with Akira and Critical Infrastructure context.", "url": "https://blog.talosintelligence.com/available-now-2024-year-in-review/", "publisher": "Cisco Talos", "published_at": "2025-03-31", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Disruption / destruction", "key": "actor-motivation:disruption-/-destruction" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Code debugging and scripting", "key": "ai-use-case:code-debugging-and-scripting" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Cronos", "key": "campaign:operation-cronos" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "CVE", "type": "cve", "value": "CVE-2014-0160", "key": "cve:cve-2014-0160" }, { "facet": "CVE", "type": "cve", "value": "CVE-2014-6271", "key": "cve:cve-2014-6271" }, { "facet": "CVE", "type": "cve", "value": "CVE-2014-6277", "key": "cve:cve-2014-6277" }, { "facet": "CVE", "type": "cve", "value": "CVE-2014-6278", "key": "cve:cve-2014-6278" }, { "facet": "CVE", "type": "cve", "value": "CVE-2014-7169", "key": "cve:cve-2014-7169" }, { "facet": "CVE", "type": "cve", "value": "CVE-2017-9841", "key": "cve:cve-2017-9841" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-44228", "key": "cve:cve-2021-44228" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-44529", "key": "cve:cve-2021-44529" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-44832", "key": "cve:cve-2021-44832" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-45046", "key": "cve:cve-2021-45046" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-45105", "key": "cve:cve-2021-45105" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-20933", "key": "cve:cve-2022-20933" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-1389", "key": "cve:cve-2023-1389" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-36845", "key": "cve:cve-2023-36845" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-38035", "key": "cve:cve-2023-38035" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-42793", "key": "cve:cve-2023-42793" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-0012", "key": "cve:cve-2024-0012" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-24919", "key": "cve:cve-2024-24919" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-3272", "key": "cve:cve-2024-3272" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-3273", "key": "cve:cve-2024-3273" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-3400", "key": "cve:cve-2024-3400" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-36401", "key": "cve:cve-2024-36401" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-4577", "key": "cve:cve-2024-4577" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "193 countries · medium confidence", "key": "metric:193-countries-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "2024 systems · medium confidence", "key": "metric:2024-systems-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "499 users · medium confidence", "key": "metric:499-users-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "5 Email · medium confidence", "key": "metric:5-email-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "50 users · medium confidence", "key": "metric:50-users-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "more than 100,000 users · medium confidence", "key": "metric:more-than-100-000-users-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "2024 YEAR · medium confidence", "key": "metric:2024-year-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$15 · medium confidence", "key": "metric:15-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1% · medium confidence", "key": "metric:1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10% · medium confidence", "key": "metric:10-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11% · medium confidence", "key": "metric:11-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12% · medium confidence", "key": "metric:12-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "14% · medium confidence", "key": "metric:14-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "16% · medium confidence", "key": "metric:16-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "17% · medium confidence", "key": "metric:17-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "18% · medium confidence", "key": "metric:18-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "19% · medium confidence", "key": "metric:19-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2% · medium confidence", "key": "metric:2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "22 % · medium confidence", "key": "metric:22-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "24% · medium confidence", "key": "metric:24-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "25% · medium confidence", "key": "metric:25-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "26% · medium confidence", "key": "metric:26-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3% · medium confidence", "key": "metric:3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "31% · medium confidence", "key": "metric:31-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "32% · medium confidence", "key": "metric:32-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "36% · medium confidence", "key": "metric:36-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4% · medium confidence", "key": "metric:4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "44% · medium confidence", "key": "metric:44-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "48% · medium confidence", "key": "metric:48-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5% · medium confidence", "key": "metric:5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "50% · medium confidence", "key": "metric:50-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "53% · medium confidence", "key": "metric:53-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "57% · medium confidence", "key": "metric:57-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "58% · medium confidence", "key": "metric:58-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6% · medium confidence", "key": "metric:6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "60% · medium confidence", "key": "metric:60-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "69% · medium confidence", "key": "metric:69-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "7% · medium confidence", "key": "metric:7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "70% · medium confidence", "key": "metric:70-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8.5% · medium confidence", "key": "metric:8.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8% · medium confidence", "key": "metric:8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "9% · medium confidence", "key": "metric:9-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "BianLian ransomware", "key": "malware-or-tool:bianlian-ransomware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "BlackBasta ransomware", "key": "malware-or-tool:blackbasta-ransomware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Cobalt Strike", "key": "malware-or-tool:cobalt-strike" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "LockBit ransomware", "key": "malware-or-tool:lockbit-ransomware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Mimikatz", "key": "malware-or-tool:mimikatz" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Cisco Talos", "key": "publisher:cisco-talos" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.talosintelligence.com", "key": "publisher-domain:blog.talosintelligence.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Legal Services", "key": "sector:legal-services" }, { "facet": "Sector", "type": "sector", "value": "Manufacturing", "key": "sector:manufacturing" }, { "facet": "Sector", "type": "sector", "value": "Nonprofit / NGO", "key": "sector:nonprofit-/-ngo" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Threat group", "type": "threat_group", "value": "Akira", "key": "threat-group:akira" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT29 / Cozy Bear", "key": "threat-group:apt29-/-cozy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "Black Basta", "key": "threat-group:black-basta" }, { "facet": "Threat group", "type": "threat_group", "value": "Lazarus Group", "key": "threat-group:lazarus-group" }, { "facet": "Threat group", "type": "threat_group", "value": "RansomHub", "key": "threat-group:ransomhub" }, { "facet": "Threat group", "type": "threat_group", "value": "Scattered Spider", "key": "threat-group:scattered-spider" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT28", "key": "threat-group-identifier:apt28" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT29", "key": "threat-group-identifier:apt29" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Password spraying", "key": "ttp:password-spraying" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Ransomware deployment", "key": "ttp:ransomware-deployment" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "TTP", "type": "ttp", "value": "Vulnerability scanning", "key": "ttp:vulnerability-scanning" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:blogs.cisco.com:c42f57d49aeb6534", "title": "Cisco Talos, The MeDoc Connection", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://blogs.cisco.com/security/talos/the-medoc-connection", "publisher": "Blogs Cisco", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blogs.cisco.com", "key": "publisher-domain:blogs.cisco.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:sec.cloudapps.cisco.com:719cbffb2b91ed49", "title": "cisco-sa-asaftd-persist-CISAED25-03", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-CISAED25-03", "publisher": "SEC Cloudapps Cisco", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sec.cloudapps.cisco.com", "key": "publisher-domain:sec.cloudapps.cisco.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:claroty.com:95e040a7738234cc", "title": "Claroty Team82’s disclosure dashboard", "description": "External source cited by 1 maintained 1200km page.", "url": "https://claroty.com/team82/disclosure-dashboard", "publisher": "Claroty", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "claroty.com", "key": "publisher-domain:claroty.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:clearskysec.com:6f9857b8a03db712", "title": "ClearSky — Operation Quicksand PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf", "publisher": "Clearskysec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "clearskysec.com", "key": "publisher-domain:clearskysec.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:clearskysec.com:84708692ccf7c184", "title": "ClearSky — Operation Quicksand: MuddyWater’s Offensive Attack Against Israeli Organizations", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.clearskysec.com/operation-quicksand", "publisher": "Clearskysec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "clearskysec.com", "key": "publisher-domain:clearskysec.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cloudsecurityalliance.org:a69d9f23f1e2fb5e", "title": "cloudsecurityalliance.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloudsecurityalliance.org/blog/2024/07/02/cloud-security-study-most-surveyed-organizations-suffered-a-cloud-related-breach-over-an-18-month-period", "publisher": "Cloudsecurityalliance", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloudsecurityalliance.org", "key": "publisher-domain:cloudsecurityalliance.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:bb1794577f6f7483", "title": "CNCF Security Whitepaper", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/cncf/tag-security", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable Kubernetes Lab: A Complete Guide to 25 Critical Security Issues", "url": "https://1200km.com/articles/read/2026/2026-02-02-building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cloud.google.com:25c8c2126305d224", "title": "Configure audit logs for Google Kubernetes Engine | Google Cloud", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:console.anthropic.com:a5915ff048168702", "title": "console.anthropic.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://console.anthropic.com", "publisher": "Console Anthropic", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "console.anthropic.com", "key": "publisher-domain:console.anthropic.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "Building a Dockerized AI-Powered Host Vulnerability Assessment Tool", "url": "https://1200km.com/articles/read/2026/2026-03-11-building-a-dockerized-ai-powered-host-vulnerability-assessment-tool-cd6e2147ce59/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:arxiv.org:b58fa5a98594b020", "title": "Context-aware Entity-Relation Extraction for Threat Intelligence Knowledge Graphs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://arxiv.org/abs/2605.15904", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:microsoft.com:635a47cb2209a9ee", "title": "cookie theft to BEC report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:coso.org:d81721792f50356f", "title": "COSO Enterprise Risk Management", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.coso.org/enterprise-risk-management", "publisher": "COSO", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "coso.org", "key": "publisher-domain:coso.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "ai-attack-reference:pub-065", "title": "CrowdStrike 2024 Global Threat Report: Executive Summary", "description": "CrowdStrike threat-research report covering Exploit development, Data exfiltration, and MFA/session-token theft. Indexed with APT28 / Fancy Bear and Government context.", "url": "https://www.crowdstrike.com/wp-content/uploads/2024/02/crowdstrike-2024-global-threat-report-executive-summary.pdf", "publisher": "CrowdStrike", "published_at": "2024-02-21", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "365 accounts · medium confidence", "key": "metric:365-accounts-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "55 countries · medium confidence", "key": "metric:55-countries-medium-confidence" }, { "facet": "Extracted metric · Breakout Time", "type": "metric", "value": "2 minutes · medium confidence", "key": "metric:2-minutes-medium-confidence" }, { "facet": "Extracted metric · Breakout Time", "type": "metric", "value": "62 minutes · medium confidence", "key": "metric:62-minutes-medium-confidence" }, { "facet": "Extracted metric · Breakout Time", "type": "metric", "value": "7 seconds · medium confidence", "key": "metric:7-seconds-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "31 seconds · medium confidence", "key": "metric:31-seconds-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "110% · medium confidence", "key": "metric:110-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "29% · medium confidence", "key": "metric:29-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "42% · medium confidence", "key": "metric:42-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "60% · medium confidence", "key": "metric:60-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "71% · medium confidence", "key": "metric:71-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "73% · medium confidence", "key": "metric:73-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "75% · medium confidence", "key": "metric:75-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "76% · medium confidence", "key": "metric:76-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "84% · medium confidence", "key": "metric:84-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "88% · medium confidence", "key": "metric:88-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "CrowdStrike", "key": "publisher:crowdstrike" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT29 / Cozy Bear", "key": "threat-group:apt29-/-cozy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "Scattered Spider", "key": "threat-group:scattered-spider" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-058", "title": "CrowdStrike 2024 Threat Hunting Report: Executive Summary", "description": "CrowdStrike threat-research report covering Obfuscation and evasion, Data exfiltration, and Defense evasion. Indexed with Scattered Spider and Financial Services context.", "url": "https://www.crowdstrike.com/en-us/press-releases/2024-crowdstrike-threat-hunting-report-highlights-nation-states-exploits/", "publisher": "CrowdStrike", "published_at": "2024-08-20", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "12 months · medium confidence", "key": "metric:12-months-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "102% · medium confidence", "key": "metric:102-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "109% · medium confidence", "key": "metric:109-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "14% · medium confidence", "key": "metric:14-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "141% · medium confidence", "key": "metric:141-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "160% · medium confidence", "key": "metric:160-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2% · medium confidence", "key": "metric:2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "25% · medium confidence", "key": "metric:25-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "27% · medium confidence", "key": "metric:27-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "29% · medium confidence", "key": "metric:29-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "36% · medium confidence", "key": "metric:36-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "41% · medium confidence", "key": "metric:41-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "42% · medium confidence", "key": "metric:42-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "43% · medium confidence", "key": "metric:43-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "44% · medium confidence", "key": "metric:44-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "51% · medium confidence", "key": "metric:51-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "52% · medium confidence", "key": "metric:52-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "55% · medium confidence", "key": "metric:55-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "57% · medium confidence", "key": "metric:57-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "58% · medium confidence", "key": "metric:58-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "60% · medium confidence", "key": "metric:60-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "7% · medium confidence", "key": "metric:7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "70% · medium confidence", "key": "metric:70-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "75% · medium confidence", "key": "metric:75-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "82% · medium confidence", "key": "metric:82-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "84% · medium confidence", "key": "metric:84-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "86% · medium confidence", "key": "metric:86-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "93% · medium confidence", "key": "metric:93-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "94% · medium confidence", "key": "metric:94-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "CrowdStrike", "key": "publisher:crowdstrike" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Healthcare", "key": "sector:healthcare" }, { "facet": "Sector", "type": "sector", "value": "Hospitality", "key": "sector:hospitality" }, { "facet": "Sector", "type": "sector", "value": "Technology", "key": "sector:technology" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "Scattered Spider", "key": "threat-group:scattered-spider" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-061", "title": "CrowdStrike 2025 Threat Hunting Report: AI Becomes a Weapon and a Target", "description": "CrowdStrike threat-research report covering Deepfake video or image, Identity fraud and impersonation, and Malware development. Indexed with APT42 / Charming Kitten, Financial Services, and Anthropic context.", "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-2025-threat-hunting-report-ai-weapon-target/", "publisher": "CrowdStrike", "published_at": "2025-08-04", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "25 Endpoint · medium confidence", "key": "metric:25-endpoint-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "26 Endpoint · medium confidence", "key": "metric:26-endpoint-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "over 320 companies · medium confidence", "key": "metric:over-320-companies-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "10 Minutes · medium confidence", "key": "metric:10-minutes-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "12 months · medium confidence", "key": "metric:12-months-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "24 hours · medium confidence", "key": "metric:24-hours-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "130% · medium confidence", "key": "metric:130-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "136% · medium confidence", "key": "metric:136-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "185% · medium confidence", "key": "metric:185-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "220% · medium confidence", "key": "metric:220-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "27% · medium confidence", "key": "metric:27-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "40% · medium confidence", "key": "metric:40-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "71% · medium confidence", "key": "metric:71-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "73% · medium confidence", "key": "metric:73-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "81% · medium confidence", "key": "metric:81-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "94% · medium confidence", "key": "metric:94-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "GenAI-built malware", "key": "malware-or-tool:genai-built-malware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "CrowdStrike", "key": "publisher:crowdstrike" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT42 / Charming Kitten", "key": "threat-group:apt42-/-charming-kitten" }, { "facet": "Threat group", "type": "threat_group", "value": "Famous Chollima", "key": "threat-group:famous-chollima" }, { "facet": "Threat group", "type": "threat_group", "value": "Scattered Spider", "key": "threat-group:scattered-spider" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Ransomware deployment", "key": "ttp:ransomware-deployment" }, { "facet": "TTP", "type": "ttp", "value": "Script generation", "key": "ttp:script-generation" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "site-reference:crowdstrike.com:22a846fc38efa1c4", "title": "CrowdStrike Falcon Intelligence", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.crowdstrike.com/products/threat-intelligence", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:crowdstrike.com:e91669575a25d4a4", "title": "CrowdStrike Global Threat Report 2024", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.crowdstrike.com/resources/reports/global-threat-report", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:crowdstrike.com:9f0ae58326a115cc", "title": "CrowdStrike, An Analysis of LightBasin Telecommunications Attacks", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.crowdstrike.com/en-us/blog/an-analysis-of-lightbasin-telecommunications-attacks", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:crowdstrike.com:4c8550b5eb07c31c", "title": "CrowdStrike, LIMINAL PANDA and telecom sector threats", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.crowdstrike.com/en-us/blog/liminal-panda-telecom-sector-threats", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:crowdstrike.com:64f28505d004a745", "title": "CrowdStrike, StellarParticle observations", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:crowdstrike.com:294ad4822ff21911", "title": "CrowdStrike, SUNSPOT", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.crowdstrike.com/en-us/blog/sunspot-malware-technical-analysis", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:crowdstrike.com:81a74def77f01545", "title": "crowdstrike.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/how-to-spot-a-phishing-email", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:raw.githubusercontent.com:3de3842571118d3a", "title": "crowdstrike/WS-CFO-01-alert-20241115.json", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/crowdstrike/WS-CFO-01-alert-20241115.json", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloudsecurityalliance.org:a1e6458850009e46", "title": "CSA Cloud Controls Matrix 4.1", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4-1", "publisher": "Cloudsecurityalliance", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloudsecurityalliance.org", "key": "publisher-domain:cloudsecurityalliance.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:nist.gov:c0834668d4e30456", "title": "CSF Quick Start Guides", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.nist.gov/cyberframework/quick-start-guides", "publisher": "NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nist.gov", "key": "publisher-domain:nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:github.com:b1d545c0139f0857", "title": "CTI as a Code repository", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/CTI_as_a_Code", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:49f248caf625555b", "title": "CTI as a Code: Complete Step-by-Step Methodology", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cti-as-a-code-complete-step-by-step-methodology-dda5ef496a46", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:639e6b3f148d7c2c", "title": "CTI/muddywater-seedworm at main · anpa1200/CTI *Open-source cyber threat intelligence reports: evidence-labeled assessments, SOC-oriented guidance, and defensive…*github.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/CTI/tree/main/muddywater-seedworm", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:91448ae93f084002", "title": "CTI/sandworm-apt44 at main · anpa1200/CTI *Contribute to anpa1200/CTI development by creating an account on GitHub.*github.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/CTI/tree/main/sandworm-apt44", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cursor.com:19c686d2b6b31218", "title": "Cursor", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cursor.com/docs/context/mcp", "publisher": "Cursor", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cursor.com", "key": "publisher-domain:cursor.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike AI: Install, Configure, and Run MCP with Gemini, OpenAI, Cursor, Llama", "url": "https://1200km.com/articles/read/2025/2025-12-18-hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cve.org:a015022048e7e788", "title": "CVE Program structure", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cve.org/ProgramOrganization/Structure", "publisher": "CVE", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cve.org", "key": "publisher-domain:cve.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:nvd.nist.gov:1361a229b8cc18c2", "title": "CVE-2022–26134", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln/detail/cve-2022-26134", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:wiz.io:895b2cd5a20cc077", "title": "CVE-2024–21626 Impact, Exploitability, and Mitigation | Wiz", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2024-21626", "publisher": "WIZ", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "wiz.io", "key": "publisher-domain:wiz.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:security.paloaltonetworks.com:7613866b0e81623a", "title": "CVE-2024–3400 advisory", "description": "External source cited by 1 maintained 1200km page.", "url": "https://security.paloaltonetworks.com/CVE-2024-3400", "publisher": "Security Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "security.paloaltonetworks.com", "key": "publisher-domain:security.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:nvd.nist.gov:e2db37c615c03c45", "title": "CVE-2025–31133", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31133", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:nvd.nist.gov:113d47976e0a60ca", "title": "CVE-2025–52565", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52565", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:nvd.nist.gov:b7164834f416e38d", "title": "CVE-2025–52881", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52881", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:a3acf07695b52430", "title": "CVSS v4.0 Enrichment Tool — KEV + EPSS + BTE automation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/cvss_4.0", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:first.org:19a05d705943428d", "title": "CVSS v4.0 Specification", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.first.org/cvss/v4-0", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:first.org:278508d1fec05ff2", "title": "CVSS v4.0 user guide", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.first.org/cvss/v4.0/user-guide", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:first.org:2065765a3e8718e8", "title": "CVSS v4.0 User Guide", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.first.org/cvss/user-guide", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:first.org:8698e9680de1e953", "title": "CVSS vs SSVC — Implementation Guide §4", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.first.org/cvss/v4.0/implementation-guide", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "ai-attack-reference:pub-083", "title": "Cyber Signals Issue 6: AI Cyber Defense for Threats | Security Insider", "description": "Microsoft provider or government report covering Deepfake video or image, Deepfake voice, and Identity fraud and impersonation. Indexed with APT43 / Kimsuky, Defense, and Microsoft context.", "url": "https://www.microsoft.com/en-us/security/security-insider/threat-landscape/cyber-signals-issue-6-navigating-cyberthreats-and-strengthening-defenses", "publisher": "Microsoft", "published_at": "2023-11", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Smishing", "key": "attack-vector:smishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "26% · medium confidence", "key": "metric:26-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "44% · medium confidence", "key": "metric:44-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "90% · medium confidence", "key": "metric:90-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "IOC · Md5", "type": "ioc", "value": "48bd494ce58f83288f1fb3dacb7267e2", "key": "ioc:48bd494ce58f83288f1fb3dacb7267e2" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text Month", "key": "publication-date-method:text-month" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Month", "key": "publication-date-precision:month" }, { "facet": "Publisher", "type": "publisher", "value": "Microsoft", "key": "publisher:microsoft" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Nonprofit / NGO", "key": "sector:nonprofit-/-ngo" }, { "facet": "Sector", "type": "sector", "value": "Technology", "key": "sector:technology" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Threat group", "type": "threat_group", "value": "APT43 / Kimsuky", "key": "threat-group:apt43-/-kimsuky" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2023", "key": "year:2023" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-089", "title": "Cyber Threat Landscape 2024: What to Expect", "description": "Proofpoint operational CTI publication covering Data exfiltration, Agentic AI, and Generative AI. Indexed with Financial Services and Anthropic context.", "url": "https://www.proofpoint.com/us/blog/threat-insight/threat-landscape-always-changing-what-expect-2024", "publisher": "Proofpoint", "published_at": "2024-01-22", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "DarkGate", "key": "malware-or-tool:darkgate" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Proofpoint", "key": "publisher:proofpoint" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "proofpoint.com", "key": "publisher-domain:proofpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA473", "key": "threat-group-identifier:ta473" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA577", "key": "threat-group-identifier:ta577" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "site-reference:misp-project.org:03c71ae2695c2b15", "title": "CyberCrime-Tracker feed via MISP default feeds", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.misp-project.org/feeds", "publisher": "MISP Project", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "misp-project.org", "key": "publisher-domain:misp-project.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cybereason.com:a94e1de4a5ffa6b9", "title": "Cybereason press release, Operation Soft Cell", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cybereason.com/press/cybereason-uncovers-massive-state-sponsored-espionage-operation-leveraging-privately-owned-critical-infrastructure-companies", "publisher": "Cybereason", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cybereason.com", "key": "publisher-domain:cybereason.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cybereason.com:dd34dac7db86c7ba", "title": "Cybereason, Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cybereason.com/blog/research/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers", "publisher": "Cybereason", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cybereason.com", "key": "publisher-domain:cybereason.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" }, { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:cyberscoop.com:601ff10f2f13ac7b", "title": "cyberscoop.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cyberscoop.com/tesla-cryptomining-redlock-cloud-breach", "publisher": "Cyberscoop", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cyberscoop.com", "key": "publisher-domain:cyberscoop.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cybersecsentinel.com:364f52fdef1c360c", "title": "cybersecsentinel.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cybersecsentinel.com/deerstealer-uses-google-authenticator-as-a-trojan-horse", "publisher": "Cybersecsentinel", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cybersecsentinel.com", "key": "publisher-domain:cybersecsentinel.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "ai-attack-reference:pub-073", "title": "Cyberthreat Predictions for 2025: An Annual Perspective from FortiGuard Labs", "description": "Fortinet forecast or strategic assessment covering Deepfake video or image, Identity fraud and impersonation, and Malware development. Indexed with APT28 / Fancy Bear and Critical Infrastructure context.", "url": "https://www.fortinet.com/uk/blog/threat-research/threat-predictions-for-2025-get-ready-for-bigger-bolder-attacks", "publisher": "Fortinet", "published_at": "2024-11-21", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Disruption / destruction", "key": "actor-motivation:disruption-/-destruction" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "12 months · medium confidence", "key": "metric:12-months-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "4.76 days · medium confidence", "key": "metric:4.76-days-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$22 Million · medium confidence", "key": "metric:22-million-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "27% · medium confidence", "key": "metric:27-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "43% · medium confidence", "key": "metric:43-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "65% · medium confidence", "key": "metric:65-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "78% · medium confidence", "key": "metric:78-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "80% · medium confidence", "key": "metric:80-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "90% · medium confidence", "key": "metric:90-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "BlackSuit ransomware", "key": "malware-or-tool:blacksuit-ransomware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Fortinet", "key": "publisher:fortinet" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "fortinet.com", "key": "publisher-domain:fortinet.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat assessment, forecast, or red-team study", "key": "relevance-basis:threat-assessment-forecast-or-red-team-study" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Energy", "key": "sector:energy" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Healthcare", "key": "sector:healthcare" }, { "facet": "Sector", "type": "sector", "value": "Manufacturing", "key": "sector:manufacturing" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "forecast or strategic assessment", "key": "source-type:forecast-or-strategic-assessment" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_only", "key": "statistical-use:context-only" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT29 / Cozy Bear", "key": "threat-group:apt29-/-cozy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT41", "key": "threat-group:apt41" }, { "facet": "Threat group", "type": "threat_group", "value": "Black Basta", "key": "threat-group:black-basta" }, { "facet": "Threat group", "type": "threat_group", "value": "Lazarus Group", "key": "threat-group:lazarus-group" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT28", "key": "threat-group-identifier:apt28" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT29", "key": "threat-group-identifier:apt29" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT41", "key": "threat-group-identifier:apt41" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Password spraying", "key": "ttp:password-spraying" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "site-reference:cyble.com:3d7d814b2b1db4d8", "title": "cyble.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cyble.com/blog/us-telecom-networks-security", "publisher": "Cyble", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cyble.com", "key": "publisher-domain:cyble.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:cyclonedx.org:4b33f81a44e6cd55", "title": "CycloneDX SBOM", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cyclonedx.org/capabilities/sbom", "publisher": "Cyclonedx", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cyclonedx.org", "key": "publisher-domain:cyclonedx.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" } ] }, { "id": "site-reference:cygwin.com:3dc31b6a9027ef1d", "title": "Cygwin’s official website", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cygwin.com", "publisher": "Cygwin", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cygwin.com", "key": "publisher-domain:cygwin.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering John the Ripper: A Complete Guide to Password Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-15-mastering-john-the-ripper-a-complete-guide-to-password-cracking-e42d68239c71/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:darkreading.com:008ec814313b9fa5", "title": "darkreading.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.darkreading.com/cyberattacks-data-breaches/uber-breach-external-contractor-mfa-bombing-attack", "publisher": "Darkreading", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "darkreading.com", "key": "publisher-domain:darkreading.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:darkreading.com:b8696a1fb462500f", "title": "darkreading.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.darkreading.com/mobile-security/all-mobile-networks-vulnerable-to-dos-impersonation-fraud-cyberattacks-through-gtp-protocol", "publisher": "Darkreading", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "darkreading.com", "key": "publisher-domain:darkreading.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:jfrog.com:723e153dfabe7d68", "title": "Data Scientists Targeted by Malicious Hugging Face ML Models", "description": "External source cited by 5 maintained 1200km pages.", "url": "https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor", "publisher": "Jfrog", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "jfrog.com", "key": "publisher-domain:jfrog.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:04c57a57a1683871", "title": "data/detections.yaml", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/blob/main/data/detections.yaml", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:30c16070f95d3367", "title": "data/procedures.yaml", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/blob/main/data/procedures.yaml", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:datacenterknowledge.com:cb7d5dc5a3f55a71", "title": "datacenterknowledge.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.datacenterknowledge.com/cloud/denonia-malware-shows-evolving-cloud-threats", "publisher": "Datacenterknowledge", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "datacenterknowledge.com", "key": "publisher-domain:datacenterknowledge.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:threathunting.net:d1b12c264b2e306e", "title": "David Bianco / Sqrrl, The Pyramid of Pain", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.threathunting.net/files/A%20Framework%20for%20Cyber%20Threat%20Hunting%20Part%201_%20The%20Pyramid%20of%20Pain%20_%20Sqrrl.pdf", "publisher": "Threathunting", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "threathunting.net", "key": "publisher-domain:threathunting.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:detect-respond.blogspot.com:b821af01bee5d160", "title": "David Bianco, The Pyramid of Pain (2013)", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html", "publisher": "Detect Respond Blogspot", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "detect-respond.blogspot.com", "key": "publisher-domain:detect-respond.blogspot.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" }, { "title": "Threat Hunting with the Pyramid of Pain", "url": "https://1200km.com/articles/read/2025/2025-07-09-threat-hunting-with-the-pyramid-of-pain-8add3cedb380/", "type": "article", "domain": "threat-hunting" }, { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:arxiv.org:2b95b6d90dc57dcd", "title": "DDPM paper", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/2006.11239", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:95dc5113334a3661", "title": "Decider", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/cisagov/Decider", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code: Complete Step-by-Step Methodology", "url": "https://1200km.com/articles/read/2026/2026-05-29-cti-as-a-code-complete-step-by-step-methodology-dda5ef496a46/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:duo.com:2efd7ea36fd952d2", "title": "Decipher — US Cyber Command Discloses MuddyWater Malware Samples", "description": "External source cited by 1 maintained 1200km page.", "url": "https://duo.com/decipher/us-cyber-command-discloses-muddywater-malware-samples", "publisher": "DUO", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "duo.com", "key": "publisher-domain:duo.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:deepinstinct.com:d48d201054d9eb9a", "title": "Deep Instinct — DarkBeatC2: The Latest MuddyWater Attack Framework", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.deepinstinct.com/blog/darkbeatc2-the-latest-muddywater-attack-framework", "publisher": "Deepinstinct", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "deepinstinct.com", "key": "publisher-domain:deepinstinct.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:deepmind.google:f1fa42fef055ab77", "title": "DeepMind’s AlphaGo", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://deepmind.google/research/alphago", "publisher": "Deepmind", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "deepmind.google", "key": "publisher-domain:deepmind.google" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "ai-attack-reference:pub-057", "title": "Defending Against an Active Threat to Siemens S7 Series PLCs | CISA", "description": "CISA government or law-enforcement publication covering Exploit development, Obfuscation and evasion, and Reconnaissance and target research. Indexed with Critical Infrastructure context.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a", "publisher": "CISA", "published_at": "2026-06-23", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0821", "key": "mitre-attack-id:t0821" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0834", "key": "mitre-attack-id:t0834" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0849", "key": "mitre-attack-id:t0849" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T0893", "key": "mitre-attack-id:t0893" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1587", "key": "mitre-attack-id:t1587" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1587.004", "key": "mitre-attack-id:t1587.004" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1588", "key": "mitre-attack-id:t1588" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1588.007", "key": "mitre-attack-id:t1588.007" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1596", "key": "mitre-attack-id:t1596" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1596.005", "key": "mitre-attack-id:t1596.005" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1694", "key": "mitre-attack-id:t1694" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "CISA", "key": "publisher:cisa" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "official advisory, fraud alert, or regional threat report", "key": "relevance-basis:official-advisory-fraud-alert-or-regional-threat-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Energy", "key": "sector:energy" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "government or law-enforcement publication", "key": "source-type:government-or-law-enforcement-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_incident", "key": "statistical-use:context-or-incident" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Script generation", "key": "ttp:script-generation" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:microsoft.com:1ad51ed17d0158cd", "title": "Defending against CVE-2025–55182 (React2Shell) in React Server Components | Microsoft Security Blog", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-017", "title": "Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering Exploit development, Vulnerability research, and Prompt injection. Indexed with Critical Infrastructure and Anthropic context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-enterprise-ai-vulnerabilities", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2026-04-17", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "TTP", "type": "ttp", "value": "Vulnerability scanning", "key": "ttp:vulnerability-scanning" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:detect.fyi:a02feed10b9c8668", "title": "detect.fyi", "description": "External source cited by 1 maintained 1200km page.", "url": "https://detect.fyi/threat-hunting-suspicious-windows-service-names-2f0dceea204c?gi=c740198b0229", "publisher": "Detect", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "detect.fyi", "key": "publisher-domain:detect.fyi" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-051", "title": "Detecting and countering malicious uses of Claude: March 2025", "description": "Anthropic provider or government report covering Identity fraud and impersonation, Influence operations, and Malware development. Indexed with Artificial Intelligence and Anthropic context.", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025", "publisher": "Anthropic", "published_at": "2025-04-23", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Anthropic", "key": "publisher:anthropic" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "anthropic.com", "key": "publisher-domain:anthropic.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Artificial Intelligence", "key": "sector:artificial-intelligence" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-052", "title": "Detecting and countering misuse of AI: August 2025", "description": "Anthropic provider or government report covering Reconnaissance and target research, Data exfiltration, and Agentic AI. Indexed with Cryptocurrency and Anthropic context.", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025", "publisher": "Anthropic", "published_at": "2025-08-27", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$1200 · medium confidence", "key": "metric:1200-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$400 · medium confidence", "key": "metric:400-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$500,000. · medium confidence", "key": "metric:500-000.-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Anthropic", "key": "publisher:anthropic" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "anthropic.com", "key": "publisher-domain:anthropic.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Technology", "key": "sector:technology" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" }, { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:detection.fyi:c8b8b019e36adf29", "title": "detection.fyi", "description": "External source cited by 1 maintained 1200km page.", "url": "https://detection.fyi/elastic/detection-rules/integrations/dga/command_and_control_ml_dga_high_sum_probability", "publisher": "Detection", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "detection.fyi", "key": "publisher-domain:detection.fyi" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:detection.fyi:ca52d61b13579399", "title": "detection.fyi", "description": "External source cited by 1 maintained 1200km page.", "url": "https://detection.fyi/elastic/detection-rules/linux/privilege_escalation_docker_escape_via_nsenter", "publisher": "Detection", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "detection.fyi", "key": "publisher-domain:detection.fyi" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:detection.fyi:21fe97387e5d31f6", "title": "detection.fyi", "description": "External source cited by 1 maintained 1200km page.", "url": "https://detection.fyi/sigmahq/sigma/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation", "publisher": "Detection", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "detection.fyi", "key": "publisher-domain:detection.fyi" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:detection.fyi:8e605351eeef5394", "title": "detection.fyi", "description": "External source cited by 1 maintained 1200km page.", "url": "https://detection.fyi/sigmahq/sigma/web/webserver_generic/web_sql_injection_in_access_logs", "publisher": "Detection", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "detection.fyi", "key": "publisher-domain:detection.fyi" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:detection.fyi:b2e721323c4c0e88", "title": "detection.fyi", "description": "External source cited by 1 maintained 1200km page.", "url": "https://detection.fyi/sigmahq/sigma/web/webserver_generic/web_xss_in_access_logs", "publisher": "Detection", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "detection.fyi", "key": "publisher-domain:detection.fyi" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:detection.fyi:1efb46264c018201", "title": "detection.fyi", "description": "External source cited by 1 maintained 1200km page.", "url": "https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_powershell_susp_download_patterns", "publisher": "Detection", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "detection.fyi", "key": "publisher-domain:detection.fyi" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:detection.fyi:dfa0905991bc4c1f", "title": "detection.fyi", "description": "External source cited by 1 maintained 1200km page.", "url": "https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_susp_eventlog_clear", "publisher": "Detection", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "detection.fyi", "key": "publisher-domain:detection.fyi" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:developer.android.com:c19baa232f69e69a", "title": "developer.android.com/studio", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://developer.android.com/studio", "publisher": "Developer Android", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "developer.android.com", "key": "publisher-domain:developer.android.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" }, { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:publicintelligence.net:b820d11bac6dd17c", "title": "DHS/FBI GRIZZLY STEPPE archival mirror", "description": "External source cited by 1 maintained 1200km page.", "url": "https://publicintelligence.net/dhs-fbi-grizzly-steppe", "publisher": "Publicintelligence", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "publicintelligence.net", "key": "publisher-domain:publicintelligence.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:dia.mil:0945fcd114e3b026", "title": "DIA photo record", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.dia.mil/News-Features/Photo-Gallery/igphoto/2000948884", "publisher": "DIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dia.mil", "key": "publisher-domain:dia.mil" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:eur-lex.europa.eu:184737d5aaed0e7e", "title": "Directive (EU) 2022/2555 — NIS2", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj?locale=en", "publisher": "EUR LEX Europa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eur-lex.europa.eu", "key": "publisher-domain:eur-lex.europa.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "ai-attack-reference:pub-027", "title": "Disrupting malicious uses of AI", "description": "OpenAI operational CTI publication covering Influence operations. Indexed with OpenAI context.", "url": "https://openai.com/global-affairs/disrupting-malicious-uses-of-ai/", "publisher": "OpenAI", "published_at": "2026-02-25", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "OpenAI", "key": "publisher:openai" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-028", "title": "Disrupting malicious uses of AI by state-affiliated threat actors", "description": "OpenAI operational CTI publication covering Code debugging and scripting, Obfuscation and evasion, and Translation and localization. Indexed with APT43 / Kimsuky and OpenAI context.", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/", "publisher": "OpenAI", "published_at": "2024-02-14", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Code debugging and scripting", "key": "ai-use-case:code-debugging-and-scripting" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "IOC · Md5", "type": "ioc", "value": "0b42f77c2478bc5bc7bde3fddfc68462", "key": "ioc:0b42f77c2478bc5bc7bde3fddfc68462" }, { "facet": "IOC · Md5", "type": "ioc", "value": "642e8632be32866792c7aaae0113aaa5", "key": "ioc:642e8632be32866792c7aaae0113aaa5" }, { "facet": "IOC · Md5", "type": "ioc", "value": "bd1bc987f38b1c2901819b4c211886a2", "key": "ioc:bd1bc987f38b1c2901819b4c211886a2" }, { "facet": "IOC · Md5", "type": "ioc", "value": "fdcc0dadabd87f8e9a776a2f34647de0", "key": "ioc:fdcc0dadabd87f8e9a776a2f34647de0" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "OpenAI", "key": "publisher:openai" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Threat group", "type": "threat_group", "value": "APT43 / Kimsuky", "key": "threat-group:apt43-/-kimsuky" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Script generation", "key": "ttp:script-generation" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" }, { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" }, { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-025", "title": "Disrupting malicious uses of AI: June 2025", "description": "OpenAI operational CTI publication covering Influence operations. Indexed with OpenAI context.", "url": "https://openai.com/global-affairs/disrupting-malicious-uses-of-ai-june-2025/", "publisher": "OpenAI", "published_at": "2025-06-05", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "OpenAI", "key": "publisher:openai" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" }, { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-026", "title": "Disrupting malicious uses of AI: October 2025", "description": "OpenAI operational CTI publication covering Influence operations. Indexed with OpenAI context.", "url": "https://openai.com/global-affairs/disrupting-malicious-uses-of-ai-october-2025/", "publisher": "OpenAI", "published_at": "2025-10-07", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "IOC · Md5", "type": "ioc", "value": "85b6659ca9e463e0750d31659f8e4cb4", "key": "ioc:85b6659ca9e463e0750d31659f8e4cb4" }, { "facet": "IOC · Md5", "type": "ioc", "value": "ab11d2d0849ad9544249bf7b77ee46fe", "key": "ioc:ab11d2d0849ad9544249bf7b77ee46fe" }, { "facet": "IOC · Md5", "type": "ioc", "value": "dba2f0e83ba4615a71894fd7fd1656e1", "key": "ioc:dba2f0e83ba4615a71894fd7fd1656e1" }, { "facet": "IOC · Md5", "type": "ioc", "value": "ff8ab22ad273ff79a4c9840f0c209fe6", "key": "ioc:ff8ab22ad273ff79a4c9840f0c209fe6" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "OpenAI", "key": "publisher:openai" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-049", "title": "Disrupting the first reported AI-orchestrated cyber espionage campaign", "description": "Anthropic provider or government report covering Autonomous or agentic intrusion, Exploit development, and Malware development. Indexed with Financial Services and Anthropic context.", "url": "https://www.anthropic.com/news/disrupting-AI-espionage", "publisher": "Anthropic", "published_at": "2025-11-13", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Autonomous or agentic intrusion", "key": "ai-use-case:autonomous-or-agentic-intrusion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Companion source", "type": "source_lineage", "value": "src-053", "key": "source-lineage:src-053" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Duplicate lineage", "type": "duplicate_group", "value": "dup-004", "key": "duplicate-group:dup-004" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Campaign Or Intrusion Duration", "type": "metric", "value": "20 minutes · medium confidence", "key": "metric:20-minutes-medium-confidence" }, { "facet": "Extracted metric · Campaign Or Intrusion Duration", "type": "metric", "value": "6 hours · medium confidence", "key": "metric:6-hours-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "10 minutes · medium confidence", "key": "metric:10-minutes-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "4 hours · medium confidence", "key": "metric:4-hours-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "90% · medium confidence", "key": "metric:90-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Anthropic", "key": "publisher:anthropic" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "anthropic.com", "key": "publisher-domain:anthropic.com" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "www-cdn.anthropic.com", "key": "publisher-domain:www-cdn.anthropic.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Manufacturing", "key": "sector:manufacturing" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Vulnerability scanning", "key": "ttp:vulnerability-scanning" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" }, { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:justice.gov:91bd1f73b9768874", "title": "DOJ KV Botnet disruption", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:justice.gov:b8c0975116dfc522", "title": "DOJ, North Korean regime-backed programmer charged", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.justice.gov/archives/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:justice.gov:96c451cd1cfa5310", "title": "DOJ, Six Russian GRU officers charged", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:kubernetes.io:c1c02f6df1520867", "title": "Downward API", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:nsarchive.gwu.edu:bb3f22fca1cd05f6", "title": "Dragos CRASHOVERRIDE PDF via National Security Archive", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3869008/Dragos-CRASHOVERRIDE-Analyzing-the-Threat-to.pdf", "publisher": "Nsarchive GWU", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nsarchive.gwu.edu", "key": "publisher-domain:nsarchive.gwu.edu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:dragos.com:06534a4c97326f37", "title": "Dragos, CRASHOVERRIDE", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.dragos.com/resource/crashoverride-analyzing-the-malware-that-attacks-power-grids", "publisher": "Dragos", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dragos.com", "key": "publisher-domain:dragos.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:elastic.co:757ebf474eff319a", "title": "e", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.elastic.co/elasticsearch/common-schema", "publisher": "Elastic", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "elastic.co", "key": "publisher-domain:elastic.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:washingtonpost.com:8b026dded292b2b0", "title": "eBay urges 145 million users to change passwords after cyber attack", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.washingtonpost.com/news/the-switch/wp/2014/05/21/ebay-asks-145-million-users-to-change-passwords-after-data-breach", "publisher": "Washingtonpost", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "washingtonpost.com", "key": "publisher-domain:washingtonpost.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:doi.org:45aec9f026510340", "title": "EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System", "description": "External source cited by 1 maintained 1200km page.", "url": "https://doi.org/10.1609/aaaiss.v7i1.36899", "publisher": "DOI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "doi.org", "key": "publisher-domain:doi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:05edf431e20cc904", "title": "EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration ( AML.CS0059 )", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://github.com/mitre-atlas/atlas-data/blob/v2026.07/dist/v6/ATLAS-2026.07.yaml", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:2af4cb7354234037", "title": "EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration ( AML.CS0059 )", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.06", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:eclypsium.com:278cba7cce5c6a7e", "title": "Eclypsium AMI MegaRAC BMC&C Part 3", "description": "External source cited by 1 maintained 1200km page.", "url": "https://eclypsium.com/blog/ami-megarac-vulnerabilities-bmc-part-3", "publisher": "Eclypsium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eclypsium.com", "key": "publisher-domain:eclypsium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:ecma-international.org:4e31b7c383aa2b13", "title": "ECMA-335 Common Language Infrastructure specification", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ecma-international.org/publications-and-standards/standards/ecma-335", "publisher": "ECMA International", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ecma-international.org", "key": "publisher-domain:ecma-international.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:cdae4f06d4d73620", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/ai-analysis/chat-assistant.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Chat Assistant", "url": "https://1200km.com/adversarygraph-docs/ai-analysis/chat-assistant/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:c8eb2b4190c57394", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/ai-analysis/domains.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Working with All Three ATT&CK Domains", "url": "https://1200km.com/adversarygraph-docs/ai-analysis/domains/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:d88eeccf51909da0", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/ai-analysis/overview.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Analysis", "url": "https://1200km.com/adversarygraph-docs/ai-analysis/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:1a15fe12ce973757", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/api/analyze.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Analysis API", "url": "https://1200km.com/adversarygraph-docs/api/analyze/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:3b1993043e02cc40", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/api/compare.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Compare API", "url": "https://1200km.com/adversarygraph-docs/api/compare/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:050d3c3a8da8e048", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/api/export.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Export API", "url": "https://1200km.com/adversarygraph-docs/api/export/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:5a497c3f8c66b6b9", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/api/layers.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Layers API", "url": "https://1200km.com/adversarygraph-docs/api/layers/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:98e9196c175f9da3", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/api/overview.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "REST API", "url": "https://1200km.com/adversarygraph-docs/api/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:03f7c4339654920c", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/api/sync.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Sync API", "url": "https://1200km.com/adversarygraph-docs/api/sync/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:61c284f4780fa623", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/apt-library/overview.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "ATT&CK Group Library", "url": "https://1200km.com/adversarygraph-docs/apt-library/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:a26c147b077ca1aa", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/architecture.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Architecture Diagrams", "url": "https://1200km.com/adversarygraph-docs/architecture/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:b82648dda37a3bd3", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/attack-data-model.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "ATT&CK and STIX Data Model", "url": "https://1200km.com/adversarygraph-docs/attack-data-model/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:9940c63b74e4be1e", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/attack-simulation.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Attack Simulation", "url": "https://1200km.com/adversarygraph-docs/attack-simulation/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:0d1f2174e71c6959", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/authentication-and-users.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Authentication And Users", "url": "https://1200km.com/adversarygraph-docs/authentication-and-users/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:7fb0337b8e91d67c", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/capabilities.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Platform Capabilities", "url": "https://1200km.com/adversarygraph-docs/capabilities/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:385b285f16ccc5ed", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/case-studies-validation.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Case Studies And Validation Examples", "url": "https://1200km.com/adversarygraph-docs/case-studies-validation/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:38081e679cb725f6", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/commercial-trust.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Commercial Trust", "url": "https://1200km.com/adversarygraph-docs/commercial-trust/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:eb0dd5140fcf8280", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/compare/campaigns.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Mode 2 — Campaigns (DB 1)", "url": "https://1200km.com/adversarygraph-docs/compare/campaigns/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:b1aec45cc7a616b2", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/compare/group-vs-group.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Group vs Group", "url": "https://1200km.com/adversarygraph-docs/compare/group-vs-group/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:ee0dfa8fa311bddf", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/compare/groups.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Mode 1 — Groups (DB 1)", "url": "https://1200km.com/adversarygraph-docs/compare/groups/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:dab16062deb793da", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/compare/overview.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Group & Campaign Similarity Deep-Dive", "url": "https://1200km.com/adversarygraph-docs/compare/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:f4926e5334fb12bc", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/compare/reports.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Mode 3 — Reports (DB 2)", "url": "https://1200km.com/adversarygraph-docs/compare/reports/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:d23a91f65e9760a6", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/comparisons/atomic-red-team.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs Atomic Red Team", "url": "https://1200km.com/adversarygraph-docs/comparisons/atomic-red-team/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:3684f10ac1153c92", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/comparisons/attack-navigator.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs ATT&CK Navigator", "url": "https://1200km.com/adversarygraph-docs/comparisons/attack-navigator/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:b14ffd24f8196c51", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/comparisons/malware-sandboxes.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs Malware Sandboxes", "url": "https://1200km.com/adversarygraph-docs/comparisons/malware-sandboxes/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:68d9d41e58aa39eb", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/comparisons/misp.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs MISP", "url": "https://1200km.com/adversarygraph-docs/comparisons/misp/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:ac09e60e4b084afc", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/comparisons/opencti.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs OpenCTI", "url": "https://1200km.com/adversarygraph-docs/comparisons/opencti/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:ce28214b38f0f838", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/comparisons/overview.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:c4f1483e6a2cad1c", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/cve-cvss-intelligence.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "CVE Library", "url": "https://1200km.com/adversarygraph-docs/cve-cvss-intelligence/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:88fdf91dece2d1c8", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/evaluation.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Evaluation and Analyst Validation", "url": "https://1200km.com/adversarygraph-docs/evaluation/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:7c41de2d160b068c", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/full-flow.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Get Started: Full Deployment Flow", "url": "https://1200km.com/adversarygraph-docs/full-flow/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:4217d6fbac5e7c56", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/functionality-parity.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Platform Scope", "url": "https://1200km.com/adversarygraph-docs/functionality-parity/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:bd7ccfd9b9dd984e", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/generating-reports.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Generating PDF Reports", "url": "https://1200km.com/adversarygraph-docs/generating-reports/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:cc6e6222dfbb48dd", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/getting-started.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Setup (10 Minutes)", "url": "https://1200km.com/adversarygraph-docs/getting-started/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:90c53e36c3eebcb1", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/intro.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph", "url": "https://1200km.com/adversarygraph-docs/intro/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:84c908b64f686cbf", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/malware-analysis.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Malware Analysis", "url": "https://1200km.com/adversarygraph-docs/malware-analysis/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:d4424aeccc0c29cb", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/navigator/import-export.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Import & Export", "url": "https://1200km.com/adversarygraph-docs/navigator/import-export/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:fc583f4fb0150580", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/navigator/layers.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Saving and Loading Named Layers", "url": "https://1200km.com/adversarygraph-docs/navigator/layers/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:691d2d792c33cd23", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/navigator/overview.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "ATT&CK Matrix Workspace", "url": "https://1200km.com/adversarygraph-docs/navigator/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:e4c7cf71274160c3", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/navigator/ttp-details.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "TTP Detail Panel", "url": "https://1200km.com/adversarygraph-docs/navigator/ttp-details/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:626cdae0d222344f", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/observability-security-validation.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Observability, Security Scanning, And Validation Examples", "url": "https://1200km.com/adversarygraph-docs/observability-security-validation/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:d1cdfda37698b264", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/operations/intelligence-pipeline.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Intelligence Pipeline", "url": "https://1200km.com/adversarygraph-docs/operations/intelligence-pipeline/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:e3aa0c5a48be80cc", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/operations/overview.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Operational Intelligence Workbench", "url": "https://1200km.com/adversarygraph-docs/operations/operations-overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:b14818f29bad2f70", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/platform-guide.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph Platform Guide", "url": "https://1200km.com/adversarygraph-docs/platform-guide/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:be508e6527615c44", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/roadmap.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Roadmap", "url": "https://1200km.com/adversarygraph-docs/roadmap/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:3af8cea648f9711b", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/security.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Security and Deployment", "url": "https://1200km.com/adversarygraph-docs/security/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:077930bae6b99d7d", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/tips.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Tips for Analysts", "url": "https://1200km.com/adversarygraph-docs/tips/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:3da0b2c39e0915b4", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/two-databases.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Two Databases: Actor Profiles and Your Report Library", "url": "https://1200km.com/adversarygraph-docs/two-databases/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:743a2ae9a899c674", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph Use Cases", "url": "https://1200km.com/adversarygraph-docs/use-cases/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:a4772112827b8ce0", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/defense-detection-content-from-intel.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Defense: Create Detection Content From CTI", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-detection-content-from-intel/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:d153a3e5991f37d0", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/defense-executive-risk-coverage-report.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Defense: Executive Risk And Coverage Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-executive-risk-coverage-report/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:f15301116b7b0683", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/defense-ioc-enrichment-pipeline.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Defense: Build IOC Enrichment Pipeline", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-ioc-enrichment-pipeline/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:f4d87129e14bbaf5", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/defense-mitre-coverage-baseline.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Defense: Build MITRE Coverage Baseline", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-mitre-coverage-baseline/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:26cc85d2e76e8188", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/defense-sector-detection-roadmap.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Defense: Create Sector-Based Detection Roadmap", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-sector-detection-roadmap/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:2d0846ed9ba1d920", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-build-sector-brief.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Build A Sector Threat Brief", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-build-sector-brief/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:b8bb0c0afc57e4fe", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-compare-incident-to-actors.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Compare Incident TTPs To Actors", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-compare-incident-to-actors/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:921eb8b53ad87ab8", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-compare-two-reports.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Compare Two Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-compare-two-reports/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:53b7b1cb9e0277bf", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-enrich-actor-iocs.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Enrich Actor IOCs", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-enrich-actor-iocs/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:e42c69cf2dae4ab1", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-import-misp-json.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Import MISP JSON", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-import-misp-json/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:b91db085f8995cf3", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-map-report-to-attack.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Map A Report To ATT&CK", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-map-report-to-attack/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:20e955cc60cf2bc7", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-pull-taxii-stix.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Pull TAXII Or Import STIX", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-pull-taxii-stix/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:8dfc9c4dd6d9f315", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-review-coverage-gap.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Review One Coverage Gap", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-review-coverage-gap/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:2d1ce912e57a99b5", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-sync-yara-sigma.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Sync YARA And Sigma Feeds", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-sync-yara-sigma/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:e51fad2e9131d204", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/intermediate-use-local-llm.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Use A Local LLM For Private Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-use-local-llm/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:441d06803e241dae", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/investigation-apt-campaign-cluster.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Investigation: Cluster Multiple APT Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-apt-campaign-cluster/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:49b32de68c664c83", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/investigation-cloud-incident.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Investigation: Cloud And Kubernetes Incident", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-cloud-incident/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:8fe0c01a849c09c6", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/investigation-malware-family.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Investigation: Malware Family Behavior Mapping", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-malware-family/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:ba59d434cc382b37", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/investigation-ransomware-intrusion.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Investigation: From Log To Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-ransomware-intrusion/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:ba0aa544dfd392fd", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/investigation-third-party-report-validation.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Investigation: Validate A Third-Party CTI Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-third-party-report-validation/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:9db985c0e7c1ded2", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-add-custom-ioc-feed.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Add A Custom IOC Feed", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-add-custom-ioc-feed/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:6545df455ab939fb", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-check-an-ioc.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Check One IOC", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-check-an-ioc/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:e883f0c063e2a29e", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-export-pdf-report.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Export A PDF Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-export-pdf-report/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:9d74c1a125171d4e", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-import-navigator-layer.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Import A Navigator Layer", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-import-navigator-layer/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:325a37862b044c7d", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-open-actor-profile.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Open One Actor Profile", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-open-actor-profile/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:28afee8cd4bbbff3", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-open-troubleshooting.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Open Troubleshooting For An Error", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-open-troubleshooting/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:0e5f1576ea910f2b", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-run-selftest.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Run Deployment Selftest", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-run-selftest/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:57ddc66710e05301", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-search-ioc-library.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Search The IOC Library", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-search-ioc-library/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:fb3487a45cc4084c", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-show-actor-on-matrix.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Show Actor TTPs On The Matrix", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-show-actor-on-matrix/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:6c985ef75b864896", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/use-cases/simple-sync-threatfox.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Sync ThreatFox IOCs", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-sync-threatfox/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:8273498199c979d7", "title": "Edit this page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph-docs/edit/main/docs/visual-guide.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph Visual Guide", "url": "https://1200km.com/adversarygraph-docs/visual-guide/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:eff.org:fb80091d4407d9db", "title": "eff.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge", "publisher": "EFF", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eff.org", "key": "publisher-domain:eff.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:eff.org:2b3676b081614ad0", "title": "eff.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.eff.org/wp/gotta-catch-em-all-understanding-how-imsi-catchers-exploit-cell-networks", "publisher": "EFF", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eff.org", "key": "publisher-domain:eff.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:elastic.co:44d6233568c79b04", "title": "elastic.co/guide/en/elasticsearch/reference/current/eql.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html", "publisher": "Elastic", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "elastic.co", "key": "publisher-domain:elastic.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-004", "title": "Emerging AI Threats: The Future of Automated Operations", "description": "Recorded Future threat-research report covering Code debugging and scripting, Deepfake video or image, and Identity fraud and impersonation. Indexed with Critical Infrastructure and Anthropic context.", "url": "https://www.recordedfuture.com/research/emerging-ai-threats-future-of-automated-operations", "publisher": "Recorded Future", "published_at": "2025-08", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Code debugging and scripting", "key": "ai-use-case:code-debugging-and-scripting" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Companion source", "type": "source_lineage", "value": "src-099", "key": "source-lineage:src-099" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Duplicate lineage", "type": "duplicate_group", "value": "dup-001", "key": "duplicate-group:dup-001" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "80 countries · medium confidence", "key": "metric:80-countries-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "15 years · medium confidence", "key": "metric:15-years-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "25% · medium confidence", "key": "metric:25-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "LAMEHUG", "key": "malware-or-tool:lamehug" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Month", "key": "publication-date-precision:month" }, { "facet": "Publisher", "type": "publisher", "value": "Recorded Future", "key": "publisher:recorded-future" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "assets.recordedfuture.com", "key": "publisher-domain:assets.recordedfuture.com" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-100", "title": "Emerging Enterprise Security Risks of AI", "description": "Recorded Future threat-research report covering Malware development, Data exfiltration, and Prompt injection.", "url": "https://www.recordedfuture.com/research/emerging-enterprise-security-risks-of-ai", "publisher": "Recorded Future", "published_at": null, "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "40% · medium confidence", "key": "metric:40-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "50% · medium confidence", "key": "metric:50-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "75% · medium confidence", "key": "metric:75-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Unknown", "key": "publication-date-method:unknown" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Unknown", "key": "publication-date-precision:unknown" }, { "facet": "Publisher", "type": "publisher", "value": "Recorded Future", "key": "publisher:recorded-future" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "Year", "type": "year", "value": "Unknown", "key": "year:unknown" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-114", "title": "Emerging threats: The intersection of criminal and technological innovation in the use of automation and artificial intelligence in the cybercrime landscape of Southeast Asia", "description": "UNODC government or law-enforcement publication covering CAPTCHA bypass, Deepfake video or image, and Deepfake voice. Indexed with FunkSec, Cryptocurrency, and OpenAI context.", "url": "https://www.unodc.org/roseap/uploads/documents/Publications/2025/UNODC_Report_Emerging_threats_-_The_intersection_of_criminal_and_technological_innovation_in_the_use_of_automation_and_AI.pdf", "publisher": "UNODC", "published_at": "2025-09", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Smishing", "key": "attack-vector:smishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "43 countries · medium confidence", "key": "metric:43-countries-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "6 companies · medium confidence", "key": "metric:6-companies-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "85 Victim · medium confidence", "key": "metric:85-victim-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "11 day · medium confidence", "key": "metric:11-day-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "20 seconds · medium confidence", "key": "metric:20-seconds-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "30 minutes · medium confidence", "key": "metric:30-minutes-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "64 Year · medium confidence", "key": "metric:64-year-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "US $25 million · medium confidence", "key": "metric:us-25-million-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "US $494,000 · medium confidence", "key": "metric:us-494-000-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "US$118,000 · medium confidence", "key": "metric:us-118-000-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "AkiraBot", "key": "malware-or-tool:akirabot" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "FunkSec", "key": "malware-or-tool:funksec" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Month", "key": "publication-date-precision:month" }, { "facet": "Publisher", "type": "publisher", "value": "UNODC", "key": "publisher:unodc" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unodc.org", "key": "publisher-domain:unodc.org" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "official advisory, fraud alert, or regional threat report", "key": "relevance-basis:official-advisory-fraud-alert-or-regional-threat-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Healthcare", "key": "sector:healthcare" }, { "facet": "Sector", "type": "sector", "value": "Hospitality", "key": "sector:hospitality" }, { "facet": "Sector", "type": "sector", "value": "Technology", "key": "sector:technology" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "government or law-enforcement publication", "key": "source-type:government-or-law-enforcement-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_incident", "key": "statistical-use:context-or-incident" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "FunkSec", "key": "threat-group:funksec" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Fake website or service", "key": "ttp:fake-website-or-service" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-092", "title": "Emerging Trends in AI-Related Cyberthreats in 2025 - Rapid7 Blog", "description": "Rapid7 threat-research report covering Deepfake video or image, Identity fraud and impersonation, and Influence operations. Indexed with APT28 / Fancy Bear and Hugging Face context.", "url": "https://www.rapid7.com/blog/post/emerging-trends-in-ai-related-cyberthreats-in-2025-impacts-on-organizational-cybersecurity/", "publisher": "Rapid7", "published_at": "2025-06-23", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Campaign", "type": "campaign", "value": "Operation ASTERIX", "key": "campaign:operation-asterix" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "Nytheon AI", "key": "malicious-ai-tool:nytheon-ai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "FunkSec", "key": "malware-or-tool:funksec" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Rapid7", "key": "publisher:rapid7" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "rapid7.com", "key": "publisher-domain:rapid7.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT31", "key": "threat-group:apt31" }, { "facet": "Threat group", "type": "threat_group", "value": "CyberAv3ngers", "key": "threat-group:cyberav3ngers" }, { "facet": "Threat group", "type": "threat_group", "value": "FunkSec", "key": "threat-group:funksec" }, { "facet": "Threat group", "type": "threat_group", "value": "Lazarus Group", "key": "threat-group:lazarus-group" }, { "facet": "Threat group", "type": "threat_group", "value": "RansomHub", "key": "threat-group:ransomhub" }, { "facet": "Threat group", "type": "threat_group", "value": "SweetSpecter", "key": "threat-group:sweetspecter" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT28", "key": "threat-group-identifier:apt28" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT31", "key": "threat-group-identifier:apt31" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Ransomware deployment", "key": "ttp:ransomware-deployment" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:en.wikipedia.org:002c3e75e383d417", "title": "en.wikipedia.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://en.wikipedia.org/wiki/Information_security", "publisher": "EN Wikipedia", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "en.wikipedia.org", "key": "publisher-domain:en.wikipedia.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:en.wikipedia.org:31f9c2d2d6d35168", "title": "en.wikipedia.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://en.wikipedia.org/wiki/ISO/IEC_27000_family", "publisher": "EN Wikipedia", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "en.wikipedia.org", "key": "publisher-domain:en.wikipedia.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:learn.microsoft.com:5b8c4c8e5b091ec9", "title": "en.wikipedia.org+2learn.microsoft.com+2thomsonreuters.com+2", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/procmon", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:enisa.europa.eu:1a46cd76d83c2663", "title": "ENISA Threat Landscape", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape", "publisher": "Enisa Europa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "enisa.europa.eu", "key": "publisher-domain:enisa.europa.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-066", "title": "ENISA Threat Landscape 2025 | ENISA", "description": "ENISA threat-research report on AI and cybersecurity.", "url": "https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025", "publisher": "ENISA", "published_at": "2025-11-06", "inclusion": "context", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "background_ai_mention", "key": "ai-relevance:background-ai-mention" }, { "facet": "Country or region", "type": "country_or_region", "value": "European Union", "key": "country-or-region:european-union" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Context only", "key": "inclusion:context-only" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "ENISA", "key": "publisher:enisa" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "enisa.europa.eu", "key": "publisher-domain:enisa.europa.eu" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:enisa.europa.eu:e71ed8f3137b2a32", "title": "ENISA Threat Landscape for 5G Networks", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.enisa.europa.eu/publications/enisa-threat-landscape-for-5g-networks", "publisher": "Enisa Europa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "enisa.europa.eu", "key": "publisher-domain:enisa.europa.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:enisa.europa.eu:cb6d5d6fab37384e", "title": "ENISA Threat Landscape Report 2024", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024", "publisher": "Enisa Europa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "enisa.europa.eu", "key": "publisher-domain:enisa.europa.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:enisa.europa.eu:7b1f094ea4fe6215", "title": "ENISA, 5G Security Controls Matrix", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.enisa.europa.eu/publications/5g-matrix/enisa-5g-security-controls-matrix-paper.pdf", "publisher": "Enisa Europa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "enisa.europa.eu", "key": "publisher-domain:enisa.europa.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:standict.eu:dcad69cb888d60a1", "title": "ENISA, 5G Threat Landscape update", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.standict.eu/sites/default/files/2021-02/ENISA%205G%20Threat%20Landscape%20-%20Update.pdf", "publisher": "Standict", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "standict.eu", "key": "publisher-domain:standict.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:learn.microsoft.com:14198461729b2528", "title": "Entra ID Protection risk detections", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "ITDR Professional Roadmap", "url": "https://1200km.com/ITDR/docs/roadmap/", "type": "documentation", "domain": "identity-security" } ] }, { "id": "site-reference:api.first.org:6654f19d283767cd", "title": "EPSS API", "description": "External source cited by 1 maintained 1200km page.", "url": "https://api.first.org/data/v1/epss?cve=CVE-XXXX-XXXXX", "publisher": "API First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "api.first.org", "key": "publisher-domain:api.first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:first.org:b5748fe1341a884e", "title": "EPSS data definition", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.first.org/epss/data.html", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:ericsson.com:ac09c73b5f7bc1df", "title": "ericsson.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ericsson.com/en/blog/2023/10/security-standards-role-in-5g", "publisher": "Ericsson", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ericsson.com", "key": "publisher-domain:ericsson.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:ericsson.com:87fa13ffb2d84adb", "title": "ericsson.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ericsson.com/en/reports-and-papers/white-papers/security-in-5g-ran-and-core-deployments", "publisher": "Ericsson", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ericsson.com", "key": "publisher-domain:ericsson.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:ericsson.com:d4f163daa3d078ce", "title": "ericsson.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ericsson.com/en/reports-and-papers/white-papers/signaling-security", "publisher": "Ericsson", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ericsson.com", "key": "publisher-domain:ericsson.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:welivesecurity.com:3361091906a62d2b", "title": "ESET / WeLiveSecurity — MuddyWater: Snakes by the riverbank", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank", "publisher": "Welivesecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "welivesecurity.com", "key": "publisher-domain:welivesecurity.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" }, { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:eset.com:a71ab69101ebae75", "title": "ESET BlackLotus research", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.eset.com/us/about/newsroom/research/eset-research-analyzes-blacklotus-a-uefi-bootkit-that-can-bypass-uefi-secure-boot-on-fully-patched-systems", "publisher": "ESET", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eset.com", "key": "publisher-domain:eset.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:eset.com:bca85983ecf50130", "title": "ESET press release — Iran’s MuddyWater targets critical infrastructure in Israel and Egypt", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.eset.com/uk/about/newsroom/press-releases/iran-muddywater-critical-infrastructure-israel-egypt-snake-game-eset-research-uk", "publisher": "ESET", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eset.com", "key": "publisher-domain:eset.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-067", "title": "ESET Threat Report: Infostealers using AI & banking malware creating deepfake videos to steal money", "description": "ESET threat-research report covering Deepfake video or image, Identity fraud and impersonation, and Translation and localization. Indexed with Critical Infrastructure and Google context.", "url": "https://www.eset.com/us/about/newsroom/press-releases/eset-threat-report-infostealers-using-ai-banking-malware-creating-deepfake-videos-to-steal-money-2/", "publisher": "ESET", "published_at": "2024-06-27", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "over 20,000 websites · medium confidence", "key": "metric:over-20-000-websites-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "30 years · medium confidence", "key": "metric:30-years-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Lumma", "key": "malware-or-tool:lumma" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Vidar", "key": "malware-or-tool:vidar" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "ESET", "key": "publisher:eset" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "eset.com", "key": "publisher-domain:eset.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "site-reference:exploit-db.com:4c94eef4e873abd4", "title": "Exploit Database (ExploitDB)", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.exploit-db.com", "publisher": "Exploit DB", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "exploit-db.com", "key": "publisher-domain:exploit-db.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" }, { "title": "The Ultimate Guide to Metasploit. Part 1.", "url": "https://1200km.com/articles/read/2024/2024-11-17-the-ultimate-guide-to-metasploit-part-1-43c8573487df/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:extrahop.com:266e7a27e0f241da", "title": "ExtraHop — The Digital Front of Iranian Cyber Offensive and Defensive Response", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.extrahop.com/blog/the-digital-front-of-iranian-cyber-offensive-and-defensive-response", "publisher": "Extrahop", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "extrahop.com", "key": "publisher-domain:extrahop.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-068", "title": "Facing reality? Law enforcement and the challenge of deepfakes | Europol", "description": "Europol research publication covering Deepfake video or image, Influence operations, and Deepfake impersonation.", "url": "https://www.europol.europa.eu/publications-events/publications/facing-reality-law-enforcement-and-challenge-of-deepfakes", "publisher": "Europol", "published_at": "2024-01", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "Country or region", "type": "country_or_region", "value": "European Union", "key": "country-or-region:european-union" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text Month", "key": "publication-date-method:text-month" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Month", "key": "publication-date-precision:month" }, { "facet": "Publisher", "type": "publisher", "value": "Europol", "key": "publisher:europol" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "europol.europa.eu", "key": "publisher-domain:europol.europa.eu" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "requires manual relevance review", "key": "relevance-basis:requires-manual-relevance-review" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "research publication", "key": "source-type:research-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "do_not_aggregate", "key": "statistical-use:do-not-aggregate" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "site-reference:falco.org:66124a2e2cfd65ee", "title": "Falco — Setup and Download | falco.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://falco.org/docs/setup/download", "publisher": "Falco", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "falco.org", "key": "publisher-domain:falco.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:falco.org:9ac5afe865672328", "title": "falco.org", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://falco.org", "publisher": "Falco", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "falco.org", "key": "publisher-domain:falco.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-046", "title": "Fashionable Phishing Bait: GenAI on the Hook", "description": "Palo Alto Networks Unit 42 operational CTI publication covering CAPTCHA bypass, Deepfake video or image, and Identity fraud and impersonation. Indexed with Akira and Legal Services context.", "url": "https://unit42.paloaltonetworks.com/genai-phishing-bait/", "publisher": "Palo Alto Networks Unit 42", "published_at": "2025-08-19", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "10 seconds · medium confidence", "key": "metric:10-seconds-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "60 seconds · medium confidence", "key": "metric:60-seconds-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11% · medium confidence", "key": "metric:11-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "16% · medium confidence", "key": "metric:16-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "30% · medium confidence", "key": "metric:30-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "40% · medium confidence", "key": "metric:40-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "70% · medium confidence", "key": "metric:70-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Palo Alto Networks Unit 42", "key": "publisher:palo-alto-networks-unit-42" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Legal Services", "key": "sector:legal-services" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "Akira", "key": "threat-group:akira" }, { "facet": "Threat group", "type": "threat_group", "value": "Lazarus Group", "key": "threat-group:lazarus-group" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:ic3.gov:38fb6fdaa4283f36", "title": "FBI IC3, 2025 Internet Crime Report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf", "publisher": "IC3", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ic3.gov", "key": "publisher-domain:ic3.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:ic3.gov:db322575b7e476eb", "title": "FBI IC3, Impersonation of Senior U.S. Officials and Their Contacts", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ic3.gov/PSA/2025/PSA250515", "publisher": "IC3", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ic3.gov", "key": "publisher-domain:ic3.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:ic3.gov:57df8d5a48a2e0be", "title": "FBI IC3, Senior U.S. Officials Impersonated in Ongoing Malicious Messaging Campaign", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ic3.gov/PSA/2025/PSA251219", "publisher": "IC3", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ic3.gov", "key": "publisher-domain:ic3.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:fbi.gov:dd22838b3e1ae7ca", "title": "FBI, Enhanced Visibility and Hardening Guidance PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.fbi.gov/file-repository/cyber-alerts/enhanced-visibility-and-hardening-guidance-for-communications-infrastructure.pdf/view", "publisher": "FBI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fbi.gov", "key": "publisher-domain:fbi.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:fbi.gov:a79aad551ef523ad", "title": "FBI, PRC targeting of U.S. telecommunications", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.fbi.gov/investigate/cyber/alerts/2025/fbi-seeking-tips-about-prc-targeting-of-us-telecommunications", "publisher": "FBI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fbi.gov", "key": "publisher-domain:fbi.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:fbi.gov:ff5483f0b2368c1f", "title": "fbi.gov", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.fbi.gov/news/press-releases/fbi-releases-annual-internet-crime-report", "publisher": "FBI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fbi.gov", "key": "publisher-domain:fbi.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:fight.mitre.org:3506821a5904b675", "title": "fight.mitre.org", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://fight.mitre.org/techniques", "publisher": "Fight Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fight.mitre.org", "key": "publisher-domain:fight.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" }, { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:fight.mitre.org:05922a0805d9b7fe", "title": "fight.mitre.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://fight.mitre.org/techniques/FGT5016", "publisher": "Fight Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fight.mitre.org", "key": "publisher-domain:fight.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:fight.mitre.org:21fdce5367c2f000", "title": "fight.mitre.org", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://fight.mitre.org/techniques/FGT5035", "publisher": "Fight Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fight.mitre.org", "key": "publisher-domain:fight.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" }, { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "ai-attack-reference:pub-070", "title": "FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions | FinCEN.gov", "description": "FinCEN government or law-enforcement publication covering Deepfake video or image, Deepfake impersonation, and Deepfake / synthetic media. Indexed with Financial Services context.", "url": "https://www.fincen.gov/news/news-releases/fincen-issues-alert-fraud-schemes-involving-deepfake-media-targeting-financial", "publisher": "FinCEN", "published_at": "2024-11-13", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "FinCEN", "key": "publisher:fincen" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "fincen.gov", "key": "publisher-domain:fincen.gov" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "official advisory, fraud alert, or regional threat report", "key": "relevance-basis:official-advisory-fraud-alert-or-regional-threat-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "government or law-enforcement publication", "key": "source-type:government-or-law-enforcement-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_incident", "key": "statistical-use:context-or-incident" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cisa.gov:dd20f4ecba10ab02", "title": "FIRESTARTER Malware Analysis Report AR26–113A", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/analysis-reports/ar26-113a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:cisa.gov:e6972fc7612def02", "title": "FIRESTARTER news release", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/news/cisa-warns-firestarter-malware-targeting-cisco-asa-including-firepower-and-secure-firewall-products", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:first.org:7ff5910365cce91d", "title": "FIRST CSIRT Services Framework 2.1", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.first.org/standards/frameworks/csirts/csirt_services_framework_v2.1", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:first.org:26e320e1b8564ad8", "title": "FIRST CTI Curriculum", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.first.org/global/sigs/cti/curriculum", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Engineering", "url": "https://1200km.com/ai-security-course.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:first.org:9d18df10bc79490c", "title": "FIRST CTI SIG Curriculum, Priority Intelligence Requirement", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.first.org/global/sigs/cti/curriculum/pir", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:first.org:d28946d8bf1ba4b9", "title": "FIRST CVSS v4.0 specification", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.first.org/cvss/specification-document", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:first.org:c2ac62b90058839c", "title": "FIRST EPSS user guide", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.first.org/epss/using-epss", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:aquasec.com:312672f25766daff", "title": "First-Ever Attack Leveraging Kubernetes RBAC to Backdoor Clusters | Aqua Nautilus", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.aquasec.com/blog/leveraging-kubernetes-rbac-to-backdoor-clusters", "publisher": "Aquasec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aquasec.com", "key": "publisher-domain:aquasec.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:first.org:a45613c7e02b226a", "title": "FIRST.org Exploit Prediction Scoring System (EPSS)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.first.org/epss", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:first.org:8c09b94b816ddfa2", "title": "FIRST.org v4.0 Calculator", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.first.org/cvss/calculator/4-0", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:github.com:e0ec203412ca421f", "title": "FLARE Learning Hub", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/mandiant/flare-learning-hub", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:docs.fluentbit.io:f27574e59b6b5ad1", "title": "Fluent Bit: grep filter", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.fluentbit.io/manual/pipeline/filters/grep", "publisher": "DOCS Fluentbit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.fluentbit.io", "key": "publisher-domain:docs.fluentbit.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:docs.fluentbit.io:f5843033d0e72cb5", "title": "Fluent Bit: Kubernetes filter", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.fluentbit.io/manual/pipeline/filters/kubernetes", "publisher": "DOCS Fluentbit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.fluentbit.io", "key": "publisher-domain:docs.fluentbit.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:forbes.com:da401edc2d474054", "title": "Forbes, Fraudsters Cloned Company Director’s Voice In $35 Million Heist, Police Find", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.forbes.com/sites/thomasbrewster/2021/10/14/huge-bank-fraud-uses-deep-fake-voice-tech-to-steal-millions", "publisher": "Forbes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "forbes.com", "key": "publisher-domain:forbes.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:forescout.com:0075518a1cc5b45f", "title": "Forescout 2025 threat report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.forescout.com/blog/2025-threat-report-exploitation-grows-across-it-iot-and-ot", "publisher": "Forescout", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "forescout.com", "key": "publisher-domain:forescout.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:forescout.com:d58b96936f807a44", "title": "Forescout riskiest connected devices 2025", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.forescout.com/research-labs/the-riskiest-devices-of-2025", "publisher": "Forescout", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "forescout.com", "key": "publisher-domain:forescout.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:forescout.com:9827efc68eeee00d", "title": "Forescout Rough Around the Edges OT/IoT router firmware", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.forescout.com/press-releases/ot-iot-router-firmware-outdated-software-vulnerabilities", "publisher": "Forescout", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "forescout.com", "key": "publisher-domain:forescout.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:sentinelone.com:25fe740eafff155b", "title": "FortiGate symlink persistence", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sentinelone.com/vulnerability-database/cve-2025-68686", "publisher": "Sentinelone", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:doi.org:1531ba929c749d17", "title": "Fredrikson, Jha, and Ristenpart — Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures", "description": "External source cited by 1 maintained 1200km page.", "url": "https://doi.org/10.1145/2810103.2813677", "publisher": "DOI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "doi.org", "key": "publisher-domain:doi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:frida.re:97ee262a31a43701", "title": "Frida documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://frida.re/docs/home", "publisher": "Frida", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "frida.re", "key": "publisher-domain:frida.re" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:frida.re:90494749c71f41b2", "title": "frida.re", "description": "External source cited by 1 maintained 1200km page.", "url": "https://frida.re", "publisher": "Frida", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "frida.re", "key": "publisher-domain:frida.re" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:frida.re:1b2f72989811fc7a", "title": "frida.re", "description": "External source cited by 1 maintained 1200km page.", "url": "https://frida.re/docs/android", "publisher": "Frida", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "frida.re", "key": "publisher-domain:frida.re" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:699850b8ea1810a0", "title": "From Log to Report: Using AdversaryGraph to Turn Firewall and EDR Noise Into a CTI Investigation", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/from-log-to-report-using-adversarygraph-eff2e1d8f2cd", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "From Log to Report: Using AdversaryGraph!", "url": "https://1200km.com/articles/read/2026/2026-06-21-from-log-to-report-using-adversarygraph-eff2e1d8f2cd/", "type": "article", "domain": "threat-intelligence" }, { "title": "Investigation: From Log To Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-ransomware-intrusion/", "type": "case-study", "domain": "platform-documentation" } ] }, { "id": "site-reference:arxiv.org:a650af94f4c36c3d", "title": "From Text to Actionable Intelligence: Automating STIX Entity and Relationship Extraction", "description": "External source cited by 1 maintained 1200km page.", "url": "https://arxiv.org/abs/2507.16576", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:fsisac.com:f926746daeff87e9", "title": "FS-ISAC", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.fsisac.com", "publisher": "Fsisac", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fsisac.com", "key": "publisher-domain:fsisac.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:docs.metasploit.com:d3cba220fe0fa89e", "title": "Full official Docs for msfvenom here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html", "publisher": "DOCS Metasploit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.metasploit.com", "key": "publisher-domain:docs.metasploit.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Ultimate Guide to Metasploit. Part 1.", "url": "https://1200km.com/articles/read/2024/2024-11-17-the-ultimate-guide-to-metasploit-part-1-43c8573487df/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:hashcat.net:092e1a0596ce994b", "title": "Full options list here", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://hashcat.net/wiki/doku.php?id=hashcat", "publisher": "Hashcat", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "hashcat.net", "key": "publisher-domain:hashcat.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Breaking the Code: How to Use Hashcat for Effective Password Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-03-breaking-the-code-how-to-use-hashcat-for-effective-password-cracking-15f8da8facb8/", "type": "article", "domain": "offensive-research" }, { "title": "Office file (DOC, DOCX, PPT…) Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-office-file-doc-docx-ppt-password-cracking-guide-with-real-life-examples-f8e356144ca4/", "type": "article", "domain": "offensive-research" }, { "title": "PDF file Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-pdf-file-password-cracking-guide-with-real-life-examples-901ee411a6f4/", "type": "article", "domain": "offensive-research" }, { "title": "ZIP file Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-zip-file-password-cracking-guide-with-real-life-examples-4e8705d51897/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-032", "title": "FunkSec – Alleged Top Ransomware Group Powered by AI - Check Point Research", "description": "Check Point provider or government report covering Identity fraud and impersonation, Malware development, and Malware generation. Indexed with Akira and OpenAI context.", "url": "https://research.checkpoint.com/2025/funksec-alleged-top-ransomware-group-powered-by-ai/", "publisher": "Check Point", "published_at": "2025-01-10", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "over 85 victims · medium confidence", "key": "metric:over-85-victims-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$10,000, · medium confidence", "key": "metric:10-000-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d", "key": "ioc:20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd", "key": "ioc:5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd", "key": "ioc:66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "7e223a685d5324491bcacf3127869f9f3ec5d5100c5e7cb5af45a227e6ab4603", "key": "ioc:7e223a685d5324491bcacf3127869f9f3ec5d5100c5e7cb5af45a227e6ab4603" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb", "key": "ioc:b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c", "key": "ioc:c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac", "key": "ioc:dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966", "key": "ioc:dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22", "key": "ioc:e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "FunkSec", "key": "malware-or-tool:funksec" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "FunkSec ransomware", "key": "malware-or-tool:funksec-ransomware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Check Point", "key": "publisher:check-point" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Threat group", "type": "threat_group", "value": "Akira", "key": "threat-group:akira" }, { "facet": "Threat group", "type": "threat_group", "value": "FunkSec", "key": "threat-group:funksec" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "site-reference:attack.mitre.org:860f2eff878cd00a", "title": "G0016", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/groups/G0016", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:attack.mitre.org:a39598dcba42e572", "title": "G0032", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/groups/G0032", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:attack.mitre.org:c2d3055b19c2d42f", "title": "G0096", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/groups/G0096", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" }, { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:raw.githubusercontent.com:e46eb32ae088bdc6", "title": "GAP-001-ws-it-levi-sysmon.md", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/GAP-001-ws-it-levi-sysmon.md", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:console.cloud.google.com:9917c9452fb07de3", "title": "GCP Console", "description": "External source cited by 1 maintained 1200km page.", "url": "https://console.cloud.google.com", "publisher": "Console Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "console.cloud.google.com", "key": "publisher-domain:console.cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:sourceware.org:081bdb4452d8ce93", "title": "GDB documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sourceware.org/gdb/documentation", "publisher": "Sourceware", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sourceware.org", "key": "publisher-domain:sourceware.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:sourceware.org:625c2b703e0d8482", "title": "GDB manual", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://sourceware.org/gdb/current/onlinedocs/gdb", "publisher": "Sourceware", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sourceware.org", "key": "publisher-domain:sourceware.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:geminicli.com:c6d5c989d10457d8", "title": "Gemini CLI+1", "description": "External source cited by 1 maintained 1200km page.", "url": "https://geminicli.com/docs/tools/mcp-server", "publisher": "Geminicli", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "geminicli.com", "key": "publisher-domain:geminicli.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Burp Suite MCP + Gemini CLI", "url": "https://1200km.com/articles/read/2026/2026-01-02-burp-suite-mcp-gemini-cli-c1229edfe092/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:982b682390c28476", "title": "Gemini-research.md", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/blob/main/docs/source-gathering/Gemini-research.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:genai.owasp.org:f81b61f57c9266bf", "title": "GenAI LLM Top 10 2026", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:shodan.io:58466b0ae0f40330", "title": "General Hacked Label Search", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=hacked", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:huggingface.co:834f4efeb6122e12", "title": "Generation strategies", "description": "External source cited by 1 maintained 1200km page.", "url": "https://huggingface.co/docs/transformers/main/generation_strategies", "publisher": "Huggingface", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "huggingface.co", "key": "publisher-domain:huggingface.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:huggingface.co:6fd764b724534fc9", "title": "Generation strategies", "description": "External source cited by 1 maintained 1200km page.", "url": "https://huggingface.co/docs/transformers/v5.15.1/generation_strategies", "publisher": "Huggingface", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "huggingface.co", "key": "publisher-domain:huggingface.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:aws.amazon.com:d4cffa03d52ef243", "title": "Getting started with Amazon EKS Auto Mode | AWS Containers Blog", "description": "External source cited by 1 maintained 1200km page.", "url": "https://aws.amazon.com/blogs/containers/getting-started-with-amazon-eks-auto-mode", "publisher": "AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aws.amazon.com", "key": "publisher-domain:aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:ghidra.re:0e21f19ac0524a01", "title": "Ghidra", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://ghidra.re", "publisher": "Ghidra", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ghidra.re", "key": "publisher-domain:ghidra.re" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:f30aa74b8135eb48", "title": "Ghidra", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/NationalSecurityAgency/ghidra", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:ghidra.re:34237db342b5e0b4", "title": "Ghidra Debugger courseware", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://ghidra.re/ghidra_docs/GhidraClass/Debugger/README.html", "publisher": "Ghidra", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ghidra.re", "key": "publisher-domain:ghidra.re" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:gitforwindows.org:c6a51ac6628e7985", "title": "Git for Windows", "description": "External source cited by 1 maintained 1200km page.", "url": "https://gitforwindows.org", "publisher": "Gitforwindows", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gitforwindows.org", "key": "publisher-domain:gitforwindows.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Nikto: Uncovering Web Server Vulnerabilities with an Open-Source Scanner", "url": "https://1200km.com/articles/read/2024/2024-11-12-nikto-uncovering-web-server-vulnerabilities-with-an-open-source-scanner-6d2d2fbc1e21/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:github.com:52a6d633d0a7334c", "title": "GitHub", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://github.com/anpa1200/Passwords", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Accessing Remote Desktops: A Beginner’s Guide to RDP Cracking with Crowbar and PPG tools", "url": "https://1200km.com/articles/read/2024/2024-10-20-accessing-remote-desktops-a-beginner-s-guide-to-rdp-cracking-with-crowbar-and-ppg-tools-5f50027115b7/", "type": "article", "domain": "network-security" }, { "title": "Personal Pass Generator (PPG): The Ultimate Tool for Custom Password Lists", "url": "https://1200km.com/articles/read/2024/2024-10-20-personal-pass-generator-ppg-the-ultimate-tool-for-custom-password-lists-4979a3a1385c/", "type": "article", "domain": "network-security" }, { "title": "WiFi cracking with Aircrack-ng", "url": "https://1200km.com/articles/read/2024/2024-10-17-wifi-cracking-with-aircrack-ng-d51cf98c789f/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:ded76b6a253ac970", "title": "GitHub", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/ibotpeaches/apktool/releases", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:2a4d7548f01974c2", "title": "GitHub", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/PortSwigger/mcp-server", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Burp Suite MCP + Gemini CLI", "url": "https://1200km.com/articles/read/2026/2026-01-02-burp-suite-mcp-gemini-cli-c1229edfe092/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:d4e1eaab70bcb24b", "title": "GitHub", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/skylot/jadx", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" }, { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:de49683760989a11", "title": "GitHub", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/WithSecureLabs/drozer/blob/develop/documentation/drozer-guide.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:60d5d6feeab95c1b", "title": "GitHub - anpa1200/adversarygraph: Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation, and SIEM validation.", "description": "External source cited by 93 maintained 1200km pages.", "url": "https://github.com/anpa1200/adversarygraph", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Add A Custom IOC Feed", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-add-custom-ioc-feed/", "type": "case-study", "domain": "platform-documentation" }, { "title": "AdversaryGraph", "url": "https://1200km.com/adversarygraph-docs/intro/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph", "url": "https://1200km.com/articles/read/2026/2026-07-23-adversarygraph-40df3439b90c/", "type": "article", "domain": "threat-intelligence" }, { "title": "AdversaryGraph Full-Version Guide — 31 Modules and Use Cases", "url": "https://1200km.com/adversarygraph/full-version-feature-guides.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "AdversaryGraph Platform Guide", "url": "https://1200km.com/adversarygraph-docs/platform-guide/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph Use Cases", "url": "https://1200km.com/adversarygraph-docs/use-cases/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph Usecases", "url": "https://1200km.com/articles/read/2026/2026-06-19-adversarygraph-usecases-820d03c3a7ab/", "type": "article", "domain": "ai-security" }, { "title": "AdversaryGraph v2.5: New Name, New Release, Full AI CTI Platform Capability Map", "url": "https://1200km.com/articles/read/2026/2026-06-19-adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e/", "type": "article", "domain": "ai-security" }, { "title": "AdversaryGraph v4.0: I Added a Full Malware Analysis Workbench to My Self-Hosted CTI Platform", "url": "https://1200km.com/articles/read/2026/2026-06-26-adversarygraph-v4-0-i-added-a-full-malware-analysis-workbench-to-my-self-hosted-cti-platfo-8dfbf1db2c9e/", "type": "article", "domain": "malware-analysis" }, { "title": "AdversaryGraph v5.0: From CTI Mapping to Attack Simulation and SIEM Validation", "url": "https://1200km.com/articles/read/2026/2026-06-29-adversarygraph-v5-0-from-cti-mapping-to-attack-simulation-and-siem-validation-21873b2a6c39/", "type": "article", "domain": "detection-engineering" }, { "title": "AdversaryGraph Visual Guide", "url": "https://1200km.com/adversarygraph-docs/visual-guide/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs Atomic Red Team", "url": "https://1200km.com/adversarygraph-docs/comparisons/atomic-red-team/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs ATT&CK Navigator", "url": "https://1200km.com/adversarygraph-docs/comparisons/attack-navigator/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs Malware Sandboxes", "url": "https://1200km.com/adversarygraph-docs/comparisons/malware-sandboxes/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs MISP", "url": "https://1200km.com/adversarygraph-docs/comparisons/misp/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs OpenCTI", "url": "https://1200km.com/adversarygraph-docs/comparisons/opencti/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AI Analysis", "url": "https://1200km.com/adversarygraph-docs/ai-analysis/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AI Chat Assistant", "url": "https://1200km.com/adversarygraph-docs/ai-analysis/chat-assistant/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Analysis API", "url": "https://1200km.com/adversarygraph-docs/api/analyze/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Architecture Diagrams", "url": "https://1200km.com/adversarygraph-docs/architecture/", "type": "documentation", "domain": "platform-documentation" }, { "title": "ATT&CK and STIX Data Model", "url": "https://1200km.com/adversarygraph-docs/attack-data-model/", "type": "documentation", "domain": "platform-documentation" }, { "title": "ATT&CK Group Library", "url": "https://1200km.com/adversarygraph-docs/apt-library/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "ATT&CK Matrix Workspace", "url": "https://1200km.com/adversarygraph-docs/navigator/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Attack Simulation", "url": "https://1200km.com/adversarygraph-docs/attack-simulation/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Authentication And Users", "url": "https://1200km.com/adversarygraph-docs/authentication-and-users/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Build A Sector Threat Brief", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-build-sector-brief/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Case Studies And Validation Examples", "url": "https://1200km.com/adversarygraph-docs/case-studies-validation/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Check One IOC", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-check-an-ioc/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Commercial Trust", "url": "https://1200km.com/adversarygraph-docs/commercial-trust/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Compare API", "url": "https://1200km.com/adversarygraph-docs/api/compare/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Compare Incident TTPs To Actors", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-compare-incident-to-actors/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Compare Two Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-compare-two-reports/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "CTI-to-detection workbench for teams that need evidence, not guesswork", "url": "https://1200km.com/adversarygraph-docs/", "type": "documentation", "domain": "platform-documentation" }, { "title": "CVE Library", "url": "https://1200km.com/adversarygraph-docs/cve-cvss-intelligence/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Defense: Build IOC Enrichment Pipeline", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-ioc-enrichment-pipeline/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Defense: Build MITRE Coverage Baseline", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-mitre-coverage-baseline/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Defense: Create Detection Content From CTI", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-detection-content-from-intel/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Defense: Create Sector-Based Detection Roadmap", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-sector-detection-roadmap/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Defense: Executive Risk And Coverage Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-executive-risk-coverage-report/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Enrich Actor IOCs", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-enrich-actor-iocs/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Evaluation and Analyst Validation", "url": "https://1200km.com/adversarygraph-docs/evaluation/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Export A PDF Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-export-pdf-report/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Export API", "url": "https://1200km.com/adversarygraph-docs/api/export/", "type": "documentation", "domain": "platform-documentation" }, { "title": "From Log to Report: Using AdversaryGraph to Turn Firewall and EDR Noise Into a CTI Investigation", "url": "https://1200km.com/articles/adversarygraph-from-log-to-report-ioc-investigation.html", "type": "case-study", "domain": "threat-intelligence" }, { "title": "From Log to Report: Using AdversaryGraph!", "url": "https://1200km.com/articles/read/2026/2026-06-21-from-log-to-report-using-adversarygraph-eff2e1d8f2cd/", "type": "article", "domain": "threat-intelligence" }, { "title": "Generating PDF Reports", "url": "https://1200km.com/adversarygraph-docs/generating-reports/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Get Started: Full Deployment Flow", "url": "https://1200km.com/adversarygraph-docs/full-flow/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Group & Campaign Similarity Deep-Dive", "url": "https://1200km.com/adversarygraph-docs/compare/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Group vs Group", "url": "https://1200km.com/adversarygraph-docs/compare/group-vs-group/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Historical: AdversaryGraph v4 Capability Map", "url": "https://1200km.com/articles/adversarygraph-v2-self-hosted-ai-cti-platform.html", "type": "mirror", "domain": "threat-intelligence" }, { "title": "Import & Export", "url": "https://1200km.com/adversarygraph-docs/navigator/import-export/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Import A Navigator Layer", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-import-navigator-layer/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Import MISP JSON", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-import-misp-json/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Intelligence Pipeline", "url": "https://1200km.com/adversarygraph-docs/operations/intelligence-pipeline/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Investigation: Cloud And Kubernetes Incident", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-cloud-incident/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Investigation: Cluster Multiple APT Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-apt-campaign-cluster/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Investigation: From Log To Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-ransomware-intrusion/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Investigation: Malware Family Behavior Mapping", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-malware-family/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Investigation: Validate A Third-Party CTI Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-third-party-report-validation/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Layers API", "url": "https://1200km.com/adversarygraph-docs/api/layers/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis", "url": "https://1200km.com/adversarygraph-docs/malware-analysis/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Map A Report To ATT&CK", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-map-report-to-attack/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Mode 1 — Groups (DB 1)", "url": "https://1200km.com/adversarygraph-docs/compare/groups/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Mode 2 — Campaigns (DB 1)", "url": "https://1200km.com/adversarygraph-docs/compare/campaigns/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Mode 3 — Reports (DB 2)", "url": "https://1200km.com/adversarygraph-docs/compare/reports/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" }, { "title": "Observability, Security Scanning, And Validation Examples", "url": "https://1200km.com/adversarygraph-docs/observability-security-validation/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Open One Actor Profile", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-open-actor-profile/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Open Troubleshooting For An Error", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-open-troubleshooting/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Operational Intelligence Workbench", "url": "https://1200km.com/adversarygraph-docs/operations/operations-overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Platform Capabilities", "url": "https://1200km.com/adversarygraph-docs/capabilities/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Platform Scope", "url": "https://1200km.com/adversarygraph-docs/functionality-parity/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Pull TAXII Or Import STIX", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-pull-taxii-stix/", "type": "case-study", "domain": "platform-documentation" }, { "title": "REST API", "url": "https://1200km.com/adversarygraph-docs/api/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Review One Coverage Gap", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-review-coverage-gap/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Roadmap", "url": "https://1200km.com/adversarygraph-docs/roadmap/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Run Deployment Selftest", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-run-selftest/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Saving and Loading Named Layers", "url": "https://1200km.com/adversarygraph-docs/navigator/layers/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Search The IOC Library", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-search-ioc-library/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Security and Deployment", "url": "https://1200km.com/adversarygraph-docs/security/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Setup (10 Minutes)", "url": "https://1200km.com/adversarygraph-docs/getting-started/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Show Actor TTPs On The Matrix", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-show-actor-on-matrix/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Sync API", "url": "https://1200km.com/adversarygraph-docs/api/sync/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Sync ThreatFox IOCs", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-sync-threatfox/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Sync YARA And Sigma Feeds", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-sync-yara-sigma/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Threat Matrix", "url": "https://1200km.com/adversarygraph-web-guide.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "Tips for Analysts", "url": "https://1200km.com/adversarygraph-docs/tips/", "type": "documentation", "domain": "platform-documentation" }, { "title": "TTP Detail Panel", "url": "https://1200km.com/adversarygraph-docs/navigator/ttp-details/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Two Databases: Actor Profiles and Your Report Library", "url": "https://1200km.com/adversarygraph-docs/two-databases/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Use A Local LLM For Private Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-use-local-llm/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Use Cases for AI-Assisted CTI, Malware Analysis, ATT&CK Mapping, IOC Investigation, and Detection Handoff", "url": "https://1200km.com/adversarygraph/use-cases.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "Working with All Three ATT&CK Domains", "url": "https://1200km.com/adversarygraph-docs/ai-analysis/domains/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:af7b2d6995954cd0", "title": "GitHub - anpa1200/AI-PT-Lab *Contribute to anpa1200/AI-PT-Lab development by creating an account on GitHub.*github.com", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://github.com/anpa1200/AI-PT-Lab", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Security", "url": "https://1200km.com/ai-offensive.html", "type": "guide", "domain": "offensive-research" }, { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" }, { "title": "Vulnerable AI Lab", "url": "https://1200km.com/articles/read/2026/2026-04-28-vulnerable-ai-lab-3747e96314dd/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:7d15853e5a3a83e4", "title": "GitHub - anpa1200/AIDebug: AI-Assisted Malware Reverse Engineering Debugger - step-by-step debugger… *AI-Assisted Malware Reverse Engineering Debugger - step-by-step debugger with Claude AI analysis of function…*github.com", "description": "External source cited by 9 maintained 1200km pages.", "url": "https://github.com/anpa1200/AIDebug", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI-Powered Malware Debugger That Explains Every Function It Sees", "url": "https://1200km.com/articles/read/2026/2026-03-14-ai-powered-malware-debugger-that-explains-every-function-it-sees-2a28ef75df8a/", "type": "article", "domain": "malware-analysis" }, { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" }, { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" }, { "title": "Course Review — TrainSec Malware Analyst Professional — Level 1", "url": "https://1200km.com/articles/read/2026/2026-08-19-course-review-trainsec-malware-analyst-professional-level-1-203ca89b76a2/", "type": "article", "domain": "malware-analysis" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" }, { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" }, { "title": "Strings Analysis for Malware Analysis: Turning Binary Text into Defensible Hypotheses", "url": "https://1200km.com/articles/read/2026/2026-08-12-strings-analysis-for-malware-analysis-turning-391815ee35e2/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:d60b72c802458a5c", "title": "GitHub - anpa1200/Android-Malware-Analysis *Contribute to anpa1200/Android-Malware-Analysis development by creating an account on GitHub.*github.com", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/anpa1200/Android-Malware-Analysis", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android APK Analysis Tool: AI-Powered Static Malware Analysis in Your Terminal", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-apk-analysis-tool-ai-powered-static-malware-analysis-in-your-terminal-4beb239dad12/", "type": "article", "domain": "malware-analysis" }, { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:d917893cb971dbb5", "title": "GitHub - anpa1200/AuditAI *Contribute to anpa1200/AuditAI development by creating an account on GitHub.*github.com", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://github.com/anpa1200/AuditAI", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "AI in Offensive Security", "url": "https://1200km.com/ai-offensive.html", "type": "guide", "domain": "offensive-research" }, { "title": "Building a Dockerized AI-Powered Host Vulnerability Assessment Tool", "url": "https://1200km.com/articles/read/2026/2026-03-11-building-a-dockerized-ai-powered-host-vulnerability-assessment-tool-cd6e2147ce59/", "type": "article", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:github.com:b4562ba3126eb21e", "title": "GitHub - anpa1200/Basic-File-Information-Gathering-Script: This repository contains a versatile… *This repository contains a versatile Python script, Basic_inf_gathering.py, designed to automate the extraction of…*github.com", "description": "External source cited by 5 maintained 1200km pages.", "url": "https://github.com/anpa1200/Basic-File-Information-Gathering-Script", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Basic Static Malware Analysis: From Triage to Unpacking — Explained and Automated", "url": "https://1200km.com/articles/read/2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8/", "type": "article", "domain": "malware-analysis" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Deep Dive: Automating Static Malware Analysis with Three Python Tools", "url": "https://1200km.com/articles/read/2025/2025-04-17-deep-dive-automating-static-malware-analysis-with-three-python-tools-46a26c0a7f87/", "type": "article", "domain": "malware-analysis" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" }, { "title": "One Tool to Rule Them All: File Metadata & Static Analysis for Malware Analysts and SOC Teams", "url": "https://1200km.com/articles/read/2026/2026-02-21-one-tool-to-rule-them-all-file-metadata-and-static-analysis-for-malware-analysts-and-soc-t-c6dba1f5b7de/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:04a76240bcd937c2", "title": "GitHub - anpa1200/dragonrx-lab *Contribute to anpa1200/dragonrx-lab development by creating an account on GitHub.*github.com", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://github.com/anpa1200/dragonrx-lab", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" }, { "title": "Lab Architecture — Operation DragonRx", "url": "https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/", "type": "article", "domain": "network-security" }, { "title": "One place for my cybersecurity projects, guides, articles, labs, tools, and research workflows", "url": "https://1200km.com/articles/read/2026/2026-05-22-one-place-for-my-cybersecurity-projects-guides-articles-labs-tools-and-research-workflows-5d358753c86c/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:758d87a3b93be3f2", "title": "GitHub - anpa1200/opencti-intelligent-shield: OpenCTI AI-driven threat intelligence enrichment with Claude and Docusaurus documentation", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/anpa1200/opencti-intelligent-shield", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Security", "url": "https://1200km.com/ai-offensive.html", "type": "guide", "domain": "offensive-research" }, { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:d1af82c73a333aa8", "title": "GitHub - anpa1200/operation-desert-hydra: OpenCTI-based CTI-to-Detection Knowledge Graph for Iranian activity against Israeli organizations", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:8e0b9ea661960e44", "title": "GitHub - anpa1200/PE-Import-Analyzer: A command-line utility to analyze the import table of PE… *A command-line utility to analyze the import table of PE files. Provides detailed DLL descriptions, API function…*github.com", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://github.com/anpa1200/PE-Import-Analyzer", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Basic Static Malware Analysis: From Triage to Unpacking — Explained and Automated", "url": "https://1200km.com/articles/read/2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8/", "type": "article", "domain": "malware-analysis" }, { "title": "Deep Dive: Automating Static Malware Analysis with Three Python Tools", "url": "https://1200km.com/articles/read/2025/2025-04-17-deep-dive-automating-static-malware-analysis-with-three-python-tools-46a26c0a7f87/", "type": "article", "domain": "malware-analysis" }, { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" }, { "title": "PE Import Analyzer: A Practical Guide for Malware Analysts and Reverse Engineers", "url": "https://1200km.com/articles/read/2026/2026-02-26-pe-import-analyzer-a-practical-guide-for-malware-analysts-and-reverse-engineers-29b8b98aeaf3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:cc61638728248407", "title": "GitHub - anpa1200/Static-malware-Analysis-Orchestrator *Contribute to anpa1200/Static-malware-Analysis-Orchestrator development by creating an account on GitHub.*github.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/Static-malware-Analysis-Orchestrator", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Basic Static Malware Analysis: From Triage to Unpacking — Explained and Automated", "url": "https://1200km.com/articles/read/2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:4ab3e0ff47b3d1fa", "title": "GitHub - anpa1200/stratus-ai: AI-powered cloud security assessment tool - automated scanning… *AI-powered cloud security assessment tool - automated scanning, Claude AI analysis, Terraform ECS deployment …*github.com", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://github.com/anpa1200/stratus-ai", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI in Offensive Security", "url": "https://1200km.com/ai-offensive.html", "type": "guide", "domain": "offensive-research" }, { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "StratusAI: I Built an AI-Powered Cloud Security Scanner for AWS and GCP — Here’s Everything", "url": "https://1200km.com/articles/read/2026/2026-03-14-stratusai-i-built-an-ai-powered-cloud-security-scanner-for-aws-and-gcp-here-s-everything-89c6702d3b84/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:github.com:1350df9087f6156c", "title": "GitHub - anpa1200/String-Analyzer: A powerful Python script to extract and analyze printable… *A powerful Python script to extract and analyze printable strings from binaries. Ideal for malware analysts, reverse…*github.com", "description": "External source cited by 5 maintained 1200km pages.", "url": "https://github.com/anpa1200/String-Analyzer", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "A Practical Guide to String Analyzer: Extract and Analyze Strings from Binaries (Without the…", "url": "https://1200km.com/articles/read/2026/2026-02-26-a-practical-guide-to-string-analyzer-extract-and-analyze-strings-from-binaries-without-the-875dc74e4868/", "type": "article", "domain": "network-security" }, { "title": "Basic Static Malware Analysis: From Triage to Unpacking — Explained and Automated", "url": "https://1200km.com/articles/read/2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8/", "type": "article", "domain": "malware-analysis" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Strings Analysis for Malware Analysis: Turning Binary Text into Defensible Hypotheses", "url": "https://1200km.com/articles/read/2026/2026-08-12-strings-analysis-for-malware-analysis-turning-391815ee35e2/", "type": "article", "domain": "malware-analysis" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:github.com:17ee8f66f98dad30", "title": "GitHub - anpa1200/threatmapper: AI-powered MITRE ATT&CK threat intelligence platform - D3.js navigator, APT comparison, Claude/GPT-4o/Gemini analysis, PDF reports", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/anpa1200/threatmapper", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AdversaryGraph v2.0: I Built a Self-Hosted AI Threat Intelligence Platform", "url": "https://1200km.com/articles/read/2026/2026-06-16-adversarygraph-v2-0-i-built-a-self-hosted-ai-threat-intelligence-platform-941a80cc5a65/", "type": "article", "domain": "ai-security" }, { "title": "AdversaryGraph: I Built a Self-Hosted AI Threat Intelligence Platform — Here’s How to Use It", "url": "https://1200km.com/articles/read/2026/2026-06-07-adversarygraph-i-built-a-self-hosted-ai-threat-intelligence-platform-here-s-how-to-use-it-0aa7673e6bd8/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:ede9f936b7faa19f", "title": "GitHub - anpa1200/Unpacker *Contribute to anpa1200/Unpacker development by creating an account on GitHub.*github.com", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/anpa1200/Unpacker", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Basic Static Malware Analysis: From Triage to Unpacking — Explained and Automated", "url": "https://1200km.com/articles/read/2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8/", "type": "article", "domain": "malware-analysis" }, { "title": "Unpacker: A Practical Guide to Modular Malware Packer Detection and Unpacking", "url": "https://1200km.com/articles/read/2026/2026-02-28-unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:669cb669a6c52fab", "title": "GitHub - anpa1200/Vulnerable-APK *Contribute to anpa1200/Vulnerable-APK development by creating an account on GitHub.*github.com", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://github.com/anpa1200/Vulnerable-APK", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Deliberately Vulnerable Android App Covering Every OWASP Mobile Top 10 Class", "url": "https://1200km.com/articles/read/2026/2026-04-08-deliberately-vulnerable-android-app-covering-every-owasp-mobile-top-10-class-7be775fc6415/", "type": "article", "domain": "site-governance" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:github.com:2ab19dcaa1de0358", "title": "GitHub — String Analyzer", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://github.com/anpa1200/String-Analyzer-", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "A Practical Guide to String Analyzer: Extract and Analyze Strings from Binaries (Without the…", "url": "https://1200km.com/articles/read/2026/2026-02-26-a-practical-guide-to-string-analyzer-extract-and-analyze-strings-from-binaries-without-the-875dc74e4868/", "type": "article", "domain": "network-security" }, { "title": "Basic Static Malware Analysis: From Triage to Unpacking — Explained and Automated", "url": "https://1200km.com/articles/read/2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8/", "type": "article", "domain": "malware-analysis" }, { "title": "Deep Dive: Automating Static Malware Analysis with Three Python Tools", "url": "https://1200km.com/articles/read/2025/2025-04-17-deep-dive-automating-static-malware-analysis-with-three-python-tools-46a26c0a7f87/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:docs.github.com:b512dc933e6934f7", "title": "GitHub Actions security hardening", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions", "publisher": "DOCS Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.github.com", "key": "publisher-domain:docs.github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:6a98537621313d24", "title": "GitHub repository", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/digininja/DiRbuster", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Mastering DirBuster: A Strategic Approach to Uncovering Hidden Web Assets", "url": "https://1200km.com/articles/read/2024/2024-11-10-mastering-dirbuster-a-strategic-approach-to-uncovering-hidden-web-assets-31c8406a892b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:docs.github.com:67c51dc142f678e1", "title": "GitHub repository visibility and security considerations", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.github.com/en/repositories/creating-and-managing-repositories/about-repositories", "publisher": "DOCS Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.github.com", "key": "publisher-domain:docs.github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:github.com:e429025b767e511b", "title": "github.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/microsoft/ProcMon-for-Linux", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:afcf94b92144e371", "title": "github.com/OTRF/Security-Datasets", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/OTRF/Security-Datasets", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:d19a9a68ec4a164e", "title": "github.com/redcanaryco/atomic-red-team", "description": "External source cited by 6 maintained 1200km pages.", "url": "https://github.com/redcanaryco/atomic-red-team", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "AdversaryGraph vs Atomic Red Team", "url": "https://1200km.com/adversarygraph-docs/comparisons/atomic-red-team/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:f072eb8a27b02e59", "title": "github.com/sbousseaden/EVTX-ATTACK-SAMPLES", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:ec0076ac99a95297", "title": "github.com/SecurityRiskAdvisors/VECTR", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/SecurityRiskAdvisors/VECTR", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:006d8a4d6e3ea249", "title": "github.com/SigmaHQ/sigma", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://github.com/SigmaHQ/sigma", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "Endpoint Threat Hunting: Proactive Detection on Windows, Linux, and macOS", "url": "https://1200km.com/articles/read/2025/2025-12-14-endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113/", "type": "article", "domain": "threat-hunting" }, { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:3028013b8143ea2b", "title": "github.com/SigmaHQ/sigma-cli", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/SigmaHQ/sigma-cli", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:f3e6dd7ad85f4fdc", "title": "github/autoWF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/autoWF", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Security", "url": "https://1200km.com/ai-offensive.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:7e0ab5136fd8645e", "title": "GitHub+1", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/mark3labs/mcphost", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike MCP Orchestration with Ollama: Ubuntu Host, Kali VM, SSH Bridging, and Performance…", "url": "https://1200km.com/articles/read/2025/2025-12-31-hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:docs.aws.amazon.com:9cba811350e54d6d", "title": "Giving Lambda functions access to resources in an Amazon VPC — AWS Lambda", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Sending EKS Control Plane Logs via AWS Lambda", "url": "https://1200km.com/articles/read/2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:7e0fad857819558d", "title": "GOAD Lab Environment", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://github.com/Orange-Cyberdefense/GOAD", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "ADCS ESC8 Attack: Certificate-Based Domain Compromise — Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-01-28-adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d/", "type": "article", "domain": "network-security" }, { "title": "Cursor + Hexstrike. Fully Automated ADCS ESC8 Attack", "url": "https://1200km.com/articles/read/2026/2026-01-29-cursor-hexstrike-fully-automated-adcs-esc8-attack-8736fec53c58/", "type": "article", "domain": "offensive-research" }, { "title": "Deploy a Complete Active Directory PenTest Lab in One Prompt with Cursor AI", "url": "https://1200km.com/articles/read/2026/2026-01-23-deploy-a-complete-active-directory-pentest-lab-in-one-prompt-with-cursor-ai-ff926fd2b3fc/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:arxiv.org:d20b6a68747b55ae", "title": "Goodfellow, Shlens, and Szegedy — Explaining and Harnessing Adversarial Examples", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1412.6572", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:cloud.google.com:4ed1afee1ad34d81", "title": "Google Cloud — Monitor models for training-serving skew", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cloud.google.com/blog/topics/developers-practitioners/monitor-models-training-serving-skew-vertex-ai", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:cloud.google.com:f2165a83e82d059a", "title": "Google Cloud / Mandiant, APT28", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt28-a-window-into-russias-cyber-espionage-operations", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:docs.cloud.google.com:9a48ce737f9dcccb", "title": "Google Cloud Documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.cloud.google.com/gemini/docs/codeassist/gemini-cli", "publisher": "DOCS Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.cloud.google.com", "key": "publisher-domain:docs.cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Burp Suite MCP + Gemini CLI", "url": "https://1200km.com/articles/read/2026/2026-01-02-burp-suite-mcp-gemini-cli-c1229edfe092/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:docs.cloud.google.com:f9fed127fc546ac4", "title": "Google Cloud shared responsibility/shared fate", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate", "publisher": "DOCS Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.cloud.google.com", "key": "publisher-domain:docs.cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:docs.cloud.google.com:3d4c4d96264e8e3c", "title": "Google Cloud Shielded VM Secure Boot certificate expiration guide", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.cloud.google.com/compute/docs/security/ms-secure-boot-certificates-expiration", "publisher": "DOCS Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.cloud.google.com", "key": "publisher-domain:docs.cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:docs.cloud.google.com:71a692ca23a01cfd", "title": "Google Cloud Well-Architected Security, Privacy, and Compliance", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.cloud.google.com/architecture/framework/security", "publisher": "DOCS Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.cloud.google.com", "key": "publisher-domain:docs.cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:developers.google.com:6189892c468b336d", "title": "Google Machine Learning Crash Course — Neural networks", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://developers.google.com/machine-learning/crash-course/neural-networks", "publisher": "Developers Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "developers.google.com", "key": "publisher-domain:developers.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:developers.google.com:7f3280b59ae86429", "title": "Google Machine Learning Crash Course — Overfitting and generalization", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://developers.google.com/machine-learning/crash-course/overfitting", "publisher": "Developers Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "developers.google.com", "key": "publisher-domain:developers.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:developers.google.com:41c32b45923b7f88", "title": "Google Machine Learning Crash Course: Classification", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://developers.google.com/machine-learning/crash-course/classification", "publisher": "Developers Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "developers.google.com", "key": "publisher-domain:developers.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:8c1aa7922daee52c", "title": "Google Security Research EntrySign advisory", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/google/security-research/security/advisories/GHSA-4xq7-4mgh-gp6w", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:google-gruyere.appspot.com:5ad94cb5640a7fb5", "title": "google-gruyere.appspot.com/", "description": "External source cited by 1 maintained 1200km page.", "url": "https://google-gruyere.appspot.com", "publisher": "Google Gruyere Appspot", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "google-gruyere.appspot.com", "key": "publisher-domain:google-gruyere.appspot.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI-Driven Web Application Pentesting with HexStrike-AI", "url": "https://1200km.com/articles/read/2025/2025-12-22-ai-driven-web-application-pentesting-with-hexstrike-ai-67f3dae32040/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:govinfo.gov:b37f86fcb8dc495f", "title": "GPO WMD Commission PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.govinfo.gov/content/pkg/GPO-WMD/pdf/GPO-WMD.pdf", "publisher": "Govinfo", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "govinfo.gov", "key": "publisher-domain:govinfo.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:group-ib.com:2dbbd807f46020f0", "title": "Group-IB — MuddyWater APT Group Profile", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.group-ib.com/masked-actors/muddywater", "publisher": "Group IB", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "group-ib.com", "key": "publisher-domain:group-ib.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:group-ib.com:6980d9bafd6e9885", "title": "Group-IB — Operation Olalampo: Inside MuddyWater’s Latest Campaign", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.group-ib.com/blog/muddywater-operation-olalampo", "publisher": "Group IB", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "group-ib.com", "key": "publisher-domain:group-ib.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" }, { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:gsma.com:f5792a84b66382cf", "title": "GSMA, Mobile Telecommunications Security Landscape 2023 PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gsma.com/security/wp-content/uploads/2023/02/GSMA-Mobile-Telecommunications-Security-Landscape-2023_v1_for-website.pdf", "publisher": "GSMA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gsma.com", "key": "publisher-domain:gsma.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:gsma.com:2bb822a08df17e09", "title": "GSMA, Mobile Telecommunications Security Landscape 2025", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gsma.com/solutions-and-impact/technologies/security/gsma-mobile-telecommunications-security-landscape-2025", "publisher": "GSMA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gsma.com", "key": "publisher-domain:gsma.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "ai-attack-reference:pub-019", "title": "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering Deepfake video or image, Exploit development, and Identity fraud and impersonation. Indexed with APT28 / Fancy Bear, Cryptocurrency, and Google context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2025-11-06", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Smishing", "key": "attack-vector:smishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Companion source", "type": "source_lineage", "value": "src-039", "key": "source-lineage:src-039" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Duplicate lineage", "type": "duplicate_group", "value": "dup-002", "key": "duplicate-group:dup-002" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "BIGMACHO backdoor", "key": "malware-or-tool:bigmacho-backdoor" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Cobalt Strike", "key": "malware-or-tool:cobalt-strike" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "LAMEHUG", "key": "malware-or-tool:lamehug" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PromptFlux", "key": "malware-or-tool:promptflux" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PromptSteal", "key": "malware-or-tool:promptsteal" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "QuietVault", "key": "malware-or-tool:quietvault" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Target", "type": "target", "value": "Security researchers", "key": "target:security-researchers" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT41", "key": "threat-group:apt41" }, { "facet": "Threat group", "type": "threat_group", "value": "APT42 / Charming Kitten", "key": "threat-group:apt42-/-charming-kitten" }, { "facet": "Threat group", "type": "threat_group", "value": "UNC1069", "key": "threat-group:unc1069" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT28", "key": "threat-group-identifier:apt28" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT41", "key": "threat-group-identifier:apt41" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT42", "key": "threat-group-identifier:apt42" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC1069", "key": "threat-group-identifier:unc1069" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC4899", "key": "threat-group-identifier:unc4899" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Script generation", "key": "ttp:script-generation" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" }, { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" }, { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-018", "title": "GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering Identity fraud and impersonation, Malware development, and Obfuscation and evasion. Indexed with APT31, Cryptocurrency, and DeepSeek context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2026-02-13", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Malicious advertisement", "key": "attack-vector:malicious-advertisement" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "DeepSeek", "key": "llm-model:deepseek" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM model", "type": "llm_model", "value": "Grok", "key": "llm-model:grok" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "DeepSeek", "key": "llm-provider:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "xAI", "key": "llm-provider:xai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "HONESTCUE malware", "key": "malware-or-tool:honestcue-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PromptFlux", "key": "malware-or-tool:promptflux" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Target", "type": "target", "value": "Security researchers", "key": "target:security-researchers" }, { "facet": "Threat group", "type": "threat_group", "value": "APT31", "key": "threat-group:apt31" }, { "facet": "Threat group", "type": "threat_group", "value": "APT41", "key": "threat-group:apt41" }, { "facet": "Threat group", "type": "threat_group", "value": "APT42 / Charming Kitten", "key": "threat-group:apt42-/-charming-kitten" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT31", "key": "threat-group-identifier:apt31" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT41", "key": "threat-group-identifier:apt41" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT42", "key": "threat-group-identifier:apt42" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC2970", "key": "threat-group-identifier:unc2970" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC5356", "key": "threat-group-identifier:unc5356" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6418", "key": "threat-group-identifier:unc6418" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC795", "key": "threat-group-identifier:unc795" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Malicious advertising", "key": "ttp:malicious-advertising" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "site-reference:arxiv.org:93af813b639ed726", "title": "Gu, Dolan-Gavitt, and Garg — BadNets", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1708.06733", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:guardz.com:a60c92f1320ecf3b", "title": "guardz.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://guardz.com/blog/33-phishing-attack-statistics-in-2024-every-msp-should-know-about", "publisher": "Guardz", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "guardz.com", "key": "publisher-domain:guardz.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:harfanglab.io:da6448b24e5a5240", "title": "HarfangLab — MuddyWater campaign abusing Atera Agents", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://harfanglab.io/insidethelab/muddywater-rmm-campaign", "publisher": "Harfanglab", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "harfanglab.io", "key": "publisher-domain:harfanglab.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" }, { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:haveibeenpwned.com:4533c1ea5b3e025b", "title": "Have I Been Pwned", "description": "External source cited by 1 maintained 1200km page.", "url": "https://haveibeenpwned.com", "publisher": "Haveibeenpwned", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "haveibeenpwned.com", "key": "publisher-domain:haveibeenpwned.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:health-isac.org:0d46a8214f2db54f", "title": "Health-ISAC / H-ISAC", "description": "External source cited by 1 maintained 1200km page.", "url": "https://health-isac.org", "publisher": "Health ISAC", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "health-isac.org", "key": "publisher-domain:health-isac.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:attack.mitre.org:24b9caa04448f3ef", "title": "here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/techniques/T1547/001", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Static Malware Analysis. Strings analysis.", "url": "https://1200km.com/articles/read/2025/2025-03-29-static-malware-analysis-strings-analysis-e876640cfdb0/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:cyberwarehub.com:e39d9500441cd5ca", "title": "here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cyberwarehub.com/tools/cff-explorer", "publisher": "Cyberwarehub", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cyberwarehub.com", "key": "publisher-domain:cyberwarehub.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:en.wikipedia.org:00761793fc9d9c84", "title": "here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://en.wikipedia.org/wiki/Windows_Registry", "publisher": "EN Wikipedia", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "en.wikipedia.org", "key": "publisher-domain:en.wikipedia.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Static Malware Analysis. Strings analysis.", "url": "https://1200km.com/articles/read/2025/2025-03-29-static-malware-analysis-strings-analysis-e876640cfdb0/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:fileinfo.com:42ef91c0b4a61e97", "title": "here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://fileinfo.com/filetypes/common", "publisher": "Fileinfo", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fileinfo.com", "key": "publisher-domain:fileinfo.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Static Malware Analysis. File Fingerprinting", "url": "https://1200km.com/articles/read/2025/2025-04-01-static-malware-analysis-file-fingerprinting-3ddf9bdd7864/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:0e36876c663f7b22", "title": "here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/daviddias/node-dirbuster/blob/master/lists/directory-list-2.3-medium.txt", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Mastering DirBuster: A Strategic Approach to Uncovering Hidden Web Assets", "url": "https://1200km.com/articles/read/2024/2024-11-10-mastering-dirbuster-a-strategic-approach-to-uncovering-hidden-web-assets-31c8406a892b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:learn.microsoft.com:003f661f89462c79", "title": "here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-libraries", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Static Malware Analysis. Strings analysis.", "url": "https://1200km.com/articles/read/2025/2025-03-29-static-malware-analysis-strings-analysis-e876640cfdb0/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:portswigger.net:d1bf954a5f197d7e", "title": "here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://portswigger.net/users/youraccount/licenses", "publisher": "Portswigger", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "portswigger.net", "key": "publisher-domain:portswigger.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Cracking Web Interfaces with Burp Suite: A Comprehensive Tutorial", "url": "https://1200km.com/articles/read/2024/2024-10-24-cracking-web-interfaces-with-burp-suite-a-comprehensive-tutorial-33087bb286b0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:garykessler.net:d52edc788715675c", "title": "here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.garykessler.net/library/file_sigs.html", "publisher": "Garykessler", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "garykessler.net", "key": "publisher-domain:garykessler.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Static Malware Analysis. File Fingerprinting", "url": "https://1200km.com/articles/read/2025/2025-04-01-static-malware-analysis-file-fingerprinting-3ddf9bdd7864/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:raw.githubusercontent.com:9d757c14526f9f4b", "title": "Here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/aws-samples/amazon-cloudwatch-container-insights/latest/k8s-deployment-manifest-templates/deployment-mode/daemonset/container-insights-monitoring/fluent-bit/fluent-bit.yaml", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:nmap.org:1a06c48229637adf", "title": "Here you can see all of NSE scripts", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nmap.org/nsedoc/scripts", "publisher": "NMAP", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nmap.org", "key": "publisher-domain:nmap.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 4. Scripts", "url": "https://1200km.com/articles/read/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:nmap.org:7fd220eae0696923", "title": "Here’s a detailed look at these categories.", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nmap.org/nsedoc/categories", "publisher": "NMAP", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nmap.org", "key": "publisher-domain:nmap.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 4. Scripts", "url": "https://1200km.com/articles/read/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:0159e9e3e498433b", "title": "HexStrike AI", "description": "External source cited by 83 maintained 1200km pages.", "url": "https://github.com/0x4m4/hexstrike-ai", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Add A Custom IOC Feed", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-add-custom-ioc-feed/", "type": "case-study", "domain": "platform-documentation" }, { "title": "AdversaryGraph", "url": "https://1200km.com/adversarygraph-docs/intro/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph Platform Guide", "url": "https://1200km.com/adversarygraph-docs/platform-guide/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph Use Cases", "url": "https://1200km.com/adversarygraph-docs/use-cases/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph Visual Guide", "url": "https://1200km.com/adversarygraph-docs/visual-guide/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs Atomic Red Team", "url": "https://1200km.com/adversarygraph-docs/comparisons/atomic-red-team/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs ATT&CK Navigator", "url": "https://1200km.com/adversarygraph-docs/comparisons/attack-navigator/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs Malware Sandboxes", "url": "https://1200km.com/adversarygraph-docs/comparisons/malware-sandboxes/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs MISP", "url": "https://1200km.com/adversarygraph-docs/comparisons/misp/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AdversaryGraph vs OpenCTI", "url": "https://1200km.com/adversarygraph-docs/comparisons/opencti/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AI Analysis", "url": "https://1200km.com/adversarygraph-docs/ai-analysis/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "AI Chat Assistant", "url": "https://1200km.com/adversarygraph-docs/ai-analysis/chat-assistant/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Analysis API", "url": "https://1200km.com/adversarygraph-docs/api/analyze/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Architecture Diagrams", "url": "https://1200km.com/adversarygraph-docs/architecture/", "type": "documentation", "domain": "platform-documentation" }, { "title": "ATT&CK and STIX Data Model", "url": "https://1200km.com/adversarygraph-docs/attack-data-model/", "type": "documentation", "domain": "platform-documentation" }, { "title": "ATT&CK Group Library", "url": "https://1200km.com/adversarygraph-docs/apt-library/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "ATT&CK Matrix Workspace", "url": "https://1200km.com/adversarygraph-docs/navigator/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Attack Simulation", "url": "https://1200km.com/adversarygraph-docs/attack-simulation/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Authentication And Users", "url": "https://1200km.com/adversarygraph-docs/authentication-and-users/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Build A Sector Threat Brief", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-build-sector-brief/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Case Studies And Validation Examples", "url": "https://1200km.com/adversarygraph-docs/case-studies-validation/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Check One IOC", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-check-an-ioc/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Commercial Trust", "url": "https://1200km.com/adversarygraph-docs/commercial-trust/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Compare API", "url": "https://1200km.com/adversarygraph-docs/api/compare/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Compare Incident TTPs To Actors", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-compare-incident-to-actors/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Compare Two Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-compare-two-reports/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "CTI-to-detection workbench for teams that need evidence, not guesswork", "url": "https://1200km.com/adversarygraph-docs/", "type": "documentation", "domain": "platform-documentation" }, { "title": "CVE Library", "url": "https://1200km.com/adversarygraph-docs/cve-cvss-intelligence/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Defense: Build IOC Enrichment Pipeline", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-ioc-enrichment-pipeline/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Defense: Build MITRE Coverage Baseline", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-mitre-coverage-baseline/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Defense: Create Detection Content From CTI", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-detection-content-from-intel/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Defense: Create Sector-Based Detection Roadmap", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-sector-detection-roadmap/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Defense: Executive Risk And Coverage Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-executive-risk-coverage-report/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Enrich Actor IOCs", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-enrich-actor-iocs/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Evaluation and Analyst Validation", "url": "https://1200km.com/adversarygraph-docs/evaluation/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Export A PDF Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-export-pdf-report/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Export API", "url": "https://1200km.com/adversarygraph-docs/api/export/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Generating PDF Reports", "url": "https://1200km.com/adversarygraph-docs/generating-reports/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Get Started: Full Deployment Flow", "url": "https://1200km.com/adversarygraph-docs/full-flow/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Group & Campaign Similarity Deep-Dive", "url": "https://1200km.com/adversarygraph-docs/compare/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Group vs Group", "url": "https://1200km.com/adversarygraph-docs/compare/group-vs-group/", "type": "documentation", "domain": "platform-documentation" }, { "title": "HexStrike AI: Install, Configure, and Run MCP with Gemini, OpenAI, Cursor, Llama", "url": "https://1200km.com/articles/read/2025/2025-12-18-hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949/", "type": "article", "domain": "offensive-research" }, { "title": "HexStrike MCP Orchestration with Ollama: Ubuntu Host, Kali VM, SSH Bridging, and Performance…", "url": "https://1200km.com/articles/read/2025/2025-12-31-hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596/", "type": "article", "domain": "offensive-research" }, { "title": "Import & Export", "url": "https://1200km.com/adversarygraph-docs/navigator/import-export/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Import A Navigator Layer", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-import-navigator-layer/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Import MISP JSON", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-import-misp-json/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Intelligence Pipeline", "url": "https://1200km.com/adversarygraph-docs/operations/intelligence-pipeline/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Investigation: Cloud And Kubernetes Incident", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-cloud-incident/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Investigation: Cluster Multiple APT Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-apt-campaign-cluster/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Investigation: From Log To Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-ransomware-intrusion/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Investigation: Malware Family Behavior Mapping", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-malware-family/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Investigation: Validate A Third-Party CTI Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-third-party-report-validation/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Layers API", "url": "https://1200km.com/adversarygraph-docs/api/layers/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis", "url": "https://1200km.com/adversarygraph-docs/malware-analysis/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Map A Report To ATT&CK", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-map-report-to-attack/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Mode 1 — Groups (DB 1)", "url": "https://1200km.com/adversarygraph-docs/compare/groups/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Mode 2 — Campaigns (DB 1)", "url": "https://1200km.com/adversarygraph-docs/compare/campaigns/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Mode 3 — Reports (DB 2)", "url": "https://1200km.com/adversarygraph-docs/compare/reports/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Observability, Security Scanning, And Validation Examples", "url": "https://1200km.com/adversarygraph-docs/observability-security-validation/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Open One Actor Profile", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-open-actor-profile/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Open Troubleshooting For An Error", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-open-troubleshooting/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Operational Intelligence Workbench", "url": "https://1200km.com/adversarygraph-docs/operations/operations-overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Platform Capabilities", "url": "https://1200km.com/adversarygraph-docs/capabilities/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Platform Scope", "url": "https://1200km.com/adversarygraph-docs/functionality-parity/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Pull TAXII Or Import STIX", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-pull-taxii-stix/", "type": "case-study", "domain": "platform-documentation" }, { "title": "REST API", "url": "https://1200km.com/adversarygraph-docs/api/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Review One Coverage Gap", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-review-coverage-gap/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Roadmap", "url": "https://1200km.com/adversarygraph-docs/roadmap/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Run Deployment Selftest", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-run-selftest/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Saving and Loading Named Layers", "url": "https://1200km.com/adversarygraph-docs/navigator/layers/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Search The IOC Library", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-search-ioc-library/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Security and Deployment", "url": "https://1200km.com/adversarygraph-docs/security/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Setup (10 Minutes)", "url": "https://1200km.com/adversarygraph-docs/getting-started/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Show Actor TTPs On The Matrix", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-show-actor-on-matrix/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Sync API", "url": "https://1200km.com/adversarygraph-docs/api/sync/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Sync ThreatFox IOCs", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-sync-threatfox/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Sync YARA And Sigma Feeds", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-sync-yara-sigma/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Tips for Analysts", "url": "https://1200km.com/adversarygraph-docs/tips/", "type": "documentation", "domain": "platform-documentation" }, { "title": "TTP Detail Panel", "url": "https://1200km.com/adversarygraph-docs/navigator/ttp-details/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Two Databases: Actor Profiles and Your Report Library", "url": "https://1200km.com/adversarygraph-docs/two-databases/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Use A Local LLM For Private Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-use-local-llm/", "type": "case-study", "domain": "platform-documentation" }, { "title": "Working with All Three ATT&CK Domains", "url": "https://1200km.com/adversarygraph-docs/ai-analysis/domains/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:medium.com:70a7ae4d4642db58", "title": "HexStrike on Kali Linux 2025.4: A Comprehensive Guide", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/hexstrike-on-kali-linux-2025-4-a-comprehensive-guide", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Navigate My Blog: All Articles by Topic", "url": "https://1200km.com/articles/read/2026/2026-03-16-navigate-my-blog-all-articles-by-topic-ffd800ef5480/", "type": "article", "domain": "offensive-research" }, { "title": "The Complete Guide to AI-Driven Penetration Testing: Cursor, MCP, and the Modern PT Workflow", "url": "https://1200km.com/articles/read/2026/2026-02-19-the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:0cc600bbffd4c6d7", "title": "HexStrike repository", "description": "External source cited by 5 maintained 1200km pages.", "url": "https://github.com/anpa1200/Hexstrike-AI", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI in Offensive Security", "url": "https://1200km.com/ai-offensive.html", "type": "guide", "domain": "offensive-research" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "HexStrike", "url": "https://1200km.com/hexstrike.html", "type": "guide", "domain": "offensive-research" }, { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:hivepro.com:310c11c6262a6419", "title": "Hive Pro — MuddyWater / Operation Olalampo PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://hivepro.com/wp-content/uploads/2026/03/TA2026082.pdf", "publisher": "Hivepro", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "hivepro.com", "key": "publisher-domain:hivepro.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:hivepro.com:7b2daa2297e410ea", "title": "Hive Pro — MuddyWater: Iran’s Adaptive Cyber Espionage Machine", "description": "External source cited by 1 maintained 1200km page.", "url": "https://hivepro.com/threat-advisory/muddywater-irans-adaptive-cyber-espionage-machine", "publisher": "Hivepro", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "hivepro.com", "key": "publisher-domain:hivepro.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-077", "title": "Hive0137 on an AI journey | IBM", "description": "IBM X-Force threat-research report covering Malware development, Obfuscation and evasion, and Phishing and lure generation. Indexed with Hospitality context.", "url": "https://www.ibm.com/think/x-force/hive0137-on-ai-journey", "publisher": "IBM X-Force", "published_at": "2025-04-04", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Endgame", "key": "campaign:operation-endgame" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "2023 campaign · medium confidence", "key": "metric:2023-campaign-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "2024 campaign · medium confidence", "key": "metric:2024-campaign-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "26 campaign · medium confidence", "key": "metric:26-campaign-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "bien-fait[.]net", "key": "ioc:bien-fait-.-net" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "continentalgames[.]top", "key": "ioc:continentalgames-.-top" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "narkology[.]top", "key": "ioc:narkology-.-top" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "newsferinfo[.]com", "key": "ioc:newsferinfo-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "raw[.]githubusercontent[.]com", "key": "ioc:raw-.-githubusercontent-.-com" }, { "facet": "IOC · Md5", "type": "ioc", "value": "473c0737f6125ad0dff41521ab1e6331", "key": "ioc:473c0737f6125ad0dff41521ab1e6331" }, { "facet": "IOC · Md5", "type": "ioc", "value": "cd457c3253556b2bce4482ebf86e829b", "key": "ioc:cd457c3253556b2bce4482ebf86e829b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "86ea22f95841f79ff10391858c1f38f8a694adf625a5d7cc49e47903c55dc8a8", "key": "ioc:86ea22f95841f79ff10391858c1f38f8a694adf625a5d7cc49e47903c55dc8a8" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "BlackBasta ransomware", "key": "malware-or-tool:blackbasta-ransomware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "DarkGate", "key": "malware-or-tool:darkgate" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "NetSupport", "key": "malware-or-tool:netsupport" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "NetSupport RAT", "key": "malware-or-tool:netsupport-rat" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "IBM X-Force", "key": "publisher:ibm-x-force" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "ibm.com", "key": "publisher-domain:ibm.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Hospitality", "key": "sector:hospitality" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA571", "key": "threat-group-identifier:ta571" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA577", "key": "threat-group-identifier:ta577" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:hkcert.org:7d49d95aeb3ac792", "title": "HKCERT, Phishing Alert — Public should be vigilant against fraudulent video conference scam using AI Deepfake technology", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.hkcert.org/security-bulletin/phishing-alert-phishing-campaigns-targeting-instagram-backup-codes-to-bypass-2fa-on-the-rise_20240207", "publisher": "Hkcert", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "hkcert.org", "key": "publisher-domain:hkcert.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:xplg.com:c65d9c3d05e71494", "title": "Home *Log management & analysis automations. Simple, optimized & cost-effective. Try free log parser, collectors, forwarding…*xplg.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://xplg.com", "publisher": "XPLG", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "xplg.com", "key": "publisher-domain:xplg.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "ai-attack-reference:pub-064", "title": "How adversaries are using GenAI for social engineering attacks", "description": "CrowdStrike threat-research report covering Deepfake video or image, Phishing and lure generation, and Business email compromise. Indexed with Famous Chollima and Anthropic context.", "url": "https://www.crowdstrike.com/en-us/resources/articles/crowdstrike-2025-global-threat-report-genai-powers-social-engineering/", "publisher": "CrowdStrike", "published_at": "2025", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "15 days · medium confidence", "key": "metric:15-days-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$25.6 million · medium confidence", "key": "metric:25.6-million-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12% · medium confidence", "key": "metric:12-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "54% · medium confidence", "key": "metric:54-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "GoldPickaxe malware", "key": "malware-or-tool:goldpickaxe-malware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Year", "key": "publication-date-precision:year" }, { "facet": "Publisher", "type": "publisher", "value": "CrowdStrike", "key": "publisher:crowdstrike" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "Famous Chollima", "key": "threat-group:famous-chollima" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-062", "title": "How CrowdStrike Hunts, Identifies and Defeats Cloud-Focused Threats", "description": "CrowdStrike threat-research report covering Obfuscation and evasion, Vulnerability research, and Obfuscation. Indexed with APT29 / Cozy Bear, Financial Services, and Anthropic context.", "url": "https://www.crowdstrike.com/en-us/blog/how-crowdstrike-hunts-identifies-and-defeats-cloud-threats/", "publisher": "CrowdStrike", "published_at": "2024-09-26", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "25 Endpoint · medium confidence", "key": "metric:25-endpoint-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "26 Endpoint · medium confidence", "key": "metric:26-endpoint-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "10 Minutes · medium confidence", "key": "metric:10-minutes-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "12 months · medium confidence", "key": "metric:12-months-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "110% · medium confidence", "key": "metric:110-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "29% · medium confidence", "key": "metric:29-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "75% · medium confidence", "key": "metric:75-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "94% · medium confidence", "key": "metric:94-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "CrowdStrike", "key": "publisher:crowdstrike" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT29 / Cozy Bear", "key": "threat-group:apt29-/-cozy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "Scattered Spider", "key": "threat-group:scattered-spider" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-063", "title": "How cyber adversaries use GenAI in vulnerability research and cloud operations", "description": "CrowdStrike threat-research report covering Exploit development, Vulnerability research, and Prompt injection. Indexed with Critical Infrastructure context.", "url": "https://www.crowdstrike.com/en-us/resources/articles/crowdstrike-2025-global-threat-report-genai-exploits-cloud-attacks/", "publisher": "CrowdStrike", "published_at": "2025", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-3400", "key": "cve:cve-2024-3400" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "15 days · medium confidence", "key": "metric:15-days-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Year", "key": "publication-date-precision:year" }, { "facet": "Publisher", "type": "publisher", "value": "CrowdStrike", "key": "publisher:crowdstrike" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:docs.aws.amazon.com:e739b30dd3b05617", "title": "How EKS Pod Identity works | AWS Documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/eks/latest/userguide/pod-id-how-it-works.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-091", "title": "How LLMs Like WormGPT Are Reshaping Cybercrime in 2025", "description": "Rapid7 threat-research report covering Deepfake video or image, Exploit development, and Identity fraud and impersonation. Indexed with Critical Infrastructure and Hugging Face context.", "url": "https://www.rapid7.com/blog/post/ai-goes-on-offense-how-llms-are-redefining-the-cybercrime-landscape/", "publisher": "Rapid7", "published_at": "2025-06-26", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Disruption / destruction", "key": "actor-motivation:disruption-/-destruction" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Campaign", "type": "campaign", "value": "Operation ASTERIX", "key": "campaign:operation-asterix" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "40% · medium confidence", "key": "metric:40-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "95% · medium confidence", "key": "metric:95-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Grok", "key": "llm-model:grok" }, { "facet": "LLM model", "type": "llm_model", "value": "Mistral / Mixtral", "key": "llm-model:mistral-/-mixtral" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Mistral AI", "key": "llm-provider:mistral-ai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "xAI", "key": "llm-provider:xai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "DarkBERT", "key": "malicious-ai-tool:darkbert" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Rapid7", "key": "publisher:rapid7" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "rapid7.com", "key": "publisher-domain:rapid7.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-090", "title": "How Social Engineering Attacks Are Evolving in 2025", "description": "Rapid7 threat-research report covering Identity fraud and impersonation, Credential harvesting, and Data exfiltration. Indexed with Black Basta and Transportation and Logistics context.", "url": "https://www.rapid7.com/blog/post/3-ways-social-engineering-is-evolving-and-what-security-teams-must-do-next/", "publisher": "Rapid7", "published_at": "2025-07-02", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Rapid7", "key": "publisher:rapid7" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "rapid7.com", "key": "publisher-domain:rapid7.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Threat group", "type": "threat_group", "value": "Black Basta", "key": "threat-group:black-basta" }, { "facet": "Threat group", "type": "threat_group", "value": "Scattered Spider", "key": "threat-group:scattered-spider" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:hoxhunt.com:763ef089ab3c5d86", "title": "hoxhunt.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://hoxhunt.com/guide/phishing-trends-report", "publisher": "Hoxhunt", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "hoxhunt.com", "key": "publisher-domain:hoxhunt.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:203.0.113.87:f4c1db3477e1f467", "title": "https://203.0.113.87/update", "description": "External source cited by 1 maintained 1200km page.", "url": "https://203.0.113.87/update", "publisher": "203 0 113", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "203.0.113.87", "key": "publisher-domain:203.0.113.87" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:91.211.251.245:4e4927cab3151ff8", "title": "https://91.211.251.245/ga.js", "description": "External source cited by 1 maintained 1200km page.", "url": "https://91.211.251.245/ga.js", "publisher": "91 211 251", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "91.211.251.245", "key": "publisher-domain:91.211.251.245" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:act.globalcyberalliance.org:79ff20a06c339275", "title": "https://act.globalcyberalliance.org/index.php/The_Diamond_Model_of_Intrusion_Analysis", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://act.globalcyberalliance.org/index.php/The_Diamond_Model_of_Intrusion_Analysis", "publisher": "ACT Globalcyberalliance", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "act.globalcyberalliance.org", "key": "publisher-domain:act.globalcyberalliance.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:aistudio.google.com:93225eea440a6b97", "title": "https://aistudio.google.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://aistudio.google.com", "publisher": "Aistudio Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aistudio.google.com", "key": "publisher-domain:aistudio.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike AI: Install, Configure, and Run MCP with Gemini, OpenAI, Cursor, Llama", "url": "https://1200km.com/articles/read/2025/2025-12-18-hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:any.run:10a0d9c0d6972fba", "title": "https://any.run", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://any.run", "publisher": "ANY", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "any.run", "key": "publisher-domain:any.run" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs Malware Sandboxes", "url": "https://1200km.com/adversarygraph-docs/comparisons/malware-sandboxes/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:api.telegram.org:4df2ed27a6267365", "title": "https://api.telegram.org/botTEST/getMe", "description": "External source cited by 1 maintained 1200km page.", "url": "https://api.telegram.org/botTEST/getMe", "publisher": "API Telegram", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "api.telegram.org", "key": "publisher-domain:api.telegram.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:apktool.org:9bd420022901f6b8", "title": "https://apktool.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://apktool.org", "publisher": "Apktool", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "apktool.org", "key": "publisher-domain:apktool.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:arxiv.org:2f8dcc726b24630f", "title": "https://arxiv.org/abs/2510.00311", "description": "External source cited by 1 maintained 1200km page.", "url": "https://arxiv.org/abs/2510.00311", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:arxiv.org:deda1a2579079033", "title": "https://arxiv.org/abs/2511.12224", "description": "External source cited by 1 maintained 1200km page.", "url": "https://arxiv.org/abs/2511.12224", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:attack.mitre.org:d106fa7812a1e4c4", "title": "https://attack.mitre.org/datacomponents", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/datacomponents", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:attack.mitre.org:eaf5ae09bb02c2b7", "title": "https://attack.mitre.org/datasources", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/datasources", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:attack.mitre.org:d177de065d919a1a", "title": "https://attack.mitre.org/techniques/T1003/006", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/techniques/T1003/006", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:attack.mitre.org:42fc891c53c3f953", "title": "https://attack.mitre.org/techniques/T1574/002", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/techniques/T1574/002", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:attack.mitre.org:8128fffc41e213ca", "title": "https://attack.mitre.org/techniques/T1596/003", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/techniques/T1596/003", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:attack.mitre.org:40cfee3138b652dc", "title": "https://attack.mitre.org/techniques/T1596/005", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/techniques/T1596/005", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:aws.amazon.com:027a84ab3718b562", "title": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-russian-cyber-threat-group-targeting-western-critical-infrastructure", "description": "External source cited by 1 maintained 1200km page.", "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-russian-cyber-threat-group-targeting-western-critical-infrastructure", "publisher": "AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aws.amazon.com", "key": "publisher-domain:aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:blog.blacklanternsecurity.com:a04db66f3e97874f", "title": "https://blog.blacklanternsecurity.com/p/detecting-dcsync", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.blacklanternsecurity.com/p/detecting-dcsync", "publisher": "BLOG Blacklanternsecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.blacklanternsecurity.com", "key": "publisher-domain:blog.blacklanternsecurity.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:blogs.blackberry.com:8c76b94ef08924fe", "title": "https://blogs.blackberry.com/en/2023/11/bibi-wiper-used-in-the-israel-hamas-war-now-runs-on-windows", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blogs.blackberry.com/en/2023/11/bibi-wiper-used-in-the-israel-hamas-war-now-runs-on-windows", "publisher": "Blogs Blackberry", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blogs.blackberry.com", "key": "publisher-domain:blogs.blackberry.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:caldera.apache.org:89daacc6790497f4", "title": "https://caldera.apache.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://caldera.apache.org", "publisher": "Caldera Apache", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "caldera.apache.org", "key": "publisher-domain:caldera.apache.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cert.pl:a7c1db755039cb8f", "title": "https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025", "publisher": "CERT", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cert.pl", "key": "publisher-domain:cert.pl" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cert.pl:7cff97ef50d52d3b", "title": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf", "publisher": "CERT", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cert.pl", "key": "publisher-domain:cert.pl" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:a2ef943ace7beb65", "title": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-dual-espionage-and-cyber-crime-operation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-dual-espionage-and-cyber-crime-operation", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:f0400a1b9de63f58", "title": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:62c182b52e453427", "title": "https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:d673c7bf714b8c78", "title": "https://cloud.google.com/blog/topics/threat-intelligence/gru-disruptive-playbook", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/gru-disruptive-playbook", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:ed1032f03296b4ef", "title": "https://cloud.google.com/blog/topics/threat-intelligence/gru-rise-telegram-minions", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/gru-rise-telegram-minions", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:39b93179c77774f9", "title": "https://cloud.google.com/blog/topics/threat-intelligence/sandworm-disrupts-power-ukraine-operational-technology", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/sandworm-disrupts-power-ukraine-operational-technology", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:23e0c2f58eaae061", "title": "https://cloud.google.com/docs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/docs", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cloud.google.com:94a7f6ffc3117e7a", "title": "https://cloud.google.com/sdk/docs/install", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cloud.google.com/sdk/docs/install", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable Cloud Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-03-13-building-a-vulnerable-cloud-pentest-lab-with-terraform-9858ac96b29e/", "type": "article", "domain": "cloud-security" }, { "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cloud.google.com:843430c7d3a4a91f", "title": "https://cloud.google.com/security/best-practices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/security/best-practices", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:community.riskiq.com:562bb39153970f2f", "title": "https://community.riskiq.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://community.riskiq.com", "publisher": "Community Riskiq", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "community.riskiq.com", "key": "publisher-domain:community.riskiq.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:crt.sh:5c34c4dbafa9da29", "title": "https://crt.sh", "description": "External source cited by 1 maintained 1200km page.", "url": "https://crt.sh", "publisher": "CRT", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crt.sh", "key": "publisher-domain:crt.sh" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:csrc.nist.gov:2549f0db00f6b320", "title": "https://csrc.nist.gov/projects/risk-management/about-rmf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://csrc.nist.gov/projects/risk-management/about-rmf", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:csrc.nist.gov:09631b42719e1b4f", "title": "https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final", "description": "External source cited by 1 maintained 1200km page.", "url": "https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:ctid.mitre.org:248a3a92dc60cad8", "title": "https://ctid.mitre.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ctid.mitre.org", "publisher": "CTID Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ctid.mitre.org", "key": "publisher-domain:ctid.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cuckoosandbox.org:18e81e0d7f8aa077", "title": "https://cuckoosandbox.org", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cuckoosandbox.org", "publisher": "Cuckoosandbox", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cuckoosandbox.org", "key": "publisher-domain:cuckoosandbox.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs Malware Sandboxes", "url": "https://1200km.com/adversarygraph-docs/comparisons/malware-sandboxes/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:cursor.sh:87a7d798988e26a3", "title": "https://cursor.sh", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cursor.sh", "publisher": "Cursor", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cursor.sh", "key": "publisher-domain:cursor.sh" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "AI-Assisted Web and Cloud Penetration Testing with Cursor + MCP HexStrike and Burp Suite MCP.", "url": "https://1200km.com/articles/read/2026/2026-01-31-ai-assisted-web-and-cloud-penetration-testing-with-cursor-mcp-hexstrike-and-burp-suite-mcp-01c02eed5258/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cyberint.com:319a16d8c3b5373b", "title": "https://cyberint.com/blog/threat-intelligence/handala-hack-what-we-know-about-the-rising-threat-actor", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cyberint.com/blog/threat-intelligence/handala-hack-what-we-know-about-the-rising-threat-actor", "publisher": "Cyberint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cyberint.com", "key": "publisher-domain:cyberint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cyberpress.org:267319f96c8776fb", "title": "https://cyberpress.org/telegram-account-compromise", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cyberpress.org/telegram-account-compromise", "publisher": "Cyberpress", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cyberpress.org", "key": "publisher-domain:cyberpress.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:developer.android.com:c95391d73adb830e", "title": "https://developer.android.com/reference/android/accessibilityservice/AccessibilityService", "description": "External source cited by 1 maintained 1200km page.", "url": "https://developer.android.com/reference/android/accessibilityservice/AccessibilityService", "publisher": "Developer Android", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "developer.android.com", "key": "publisher-domain:developer.android.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:dnsdumpster.com:b7e2a0e77f34f7f0", "title": "https://dnsdumpster.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://dnsdumpster.com", "publisher": "Dnsdumpster", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dnsdumpster.com", "key": "publisher-domain:dnsdumpster.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Web Applications Penetretion Testing. Stage 1: Reconnaissance", "url": "https://1200km.com/articles/read/2024/2024-11-10-web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:dnslytics.com:aef53431cccd292c", "title": "https://dnslytics.com/domain/example.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://dnslytics.com/domain/example.com", "publisher": "Dnslytics", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dnslytics.com", "key": "publisher-domain:dnslytics.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:dnslytics.com:a4cc61bf91ae9ae2", "title": "https://dnslytics.com/reverse-ns/elliott.ns.cloudflare.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://dnslytics.com/reverse-ns/elliott.ns.cloudflare.com", "publisher": "Dnslytics", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dnslytics.com", "key": "publisher-domain:dnslytics.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:docs.aws.amazon.com:982ed93a9363b319", "title": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.aws.amazon.com:a1508169084fd6f4", "title": "https://docs.aws.amazon.com/cli/latest/reference/eks/update-kubeconfig.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/cli/latest/reference/eks/update-kubeconfig.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:docs.aws.amazon.com:f2a98602172b27d2", "title": "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable Cloud Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-03-13-building-a-vulnerable-cloud-pentest-lab-with-terraform-9858ac96b29e/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:docs.aws.amazon.com:edb2b5ed5e3e2083", "title": "https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:docs.aws.amazon.com:9d680fe93fff9dbf", "title": "https://docs.aws.amazon.com/security-lake/latest/userguide/open-cybersecurity-schema-framework.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/security-lake/latest/userguide/open-cybersecurity-schema-framework.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.aws.amazon.com:9d8ed91767197043", "title": "https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.cloud.google.com:c3d53490aaceeb77", "title": "https://docs.cloud.google.com/chronicle/docs/investigation/multi-stage-yaral", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.cloud.google.com/chronicle/docs/investigation/multi-stage-yaral", "publisher": "DOCS Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.cloud.google.com", "key": "publisher-domain:docs.cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.cloud.google.com:fa335320f2e07c0b", "title": "https://docs.cloud.google.com/chronicle/docs/yara-l/yara-l-2-0-examples", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.cloud.google.com/chronicle/docs/yara-l/yara-l-2-0-examples", "publisher": "DOCS Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.cloud.google.com", "key": "publisher-domain:docs.cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.cloud.google.com:c27d52b481121ae0", "title": "https://docs.cloud.google.com/logging/docs/audit", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.cloud.google.com/logging/docs/audit", "publisher": "DOCS Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.cloud.google.com", "key": "publisher-domain:docs.cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.fluentbit.io:891b5e36c25e62a0", "title": "https://docs.fluentbit.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.fluentbit.io", "publisher": "DOCS Fluentbit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.fluentbit.io", "key": "publisher-domain:docs.fluentbit.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:docs.github.com:215dc07e3642e79b", "title": "https://docs.github.com/en/actions/reference/security/secure-use", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.github.com/en/actions/reference/security/secure-use", "publisher": "DOCS Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.github.com", "key": "publisher-domain:docs.github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.microsoft.com:ccc87f2e13d6b953", "title": "https://docs.microsoft.com/en-us/windows-server/identity/ad-cs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.microsoft.com/en-us/windows-server/identity/ad-cs", "publisher": "DOCS Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.microsoft.com", "key": "publisher-domain:docs.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "ADCS ESC8 Attack: Certificate-Based Domain Compromise — Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-01-28-adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:docs.oasis-open.org:5043b91f097b3fad", "title": "https://docs.oasis-open.org/cti/taxii/v2.1/taxii-v2.1.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.oasis-open.org/cti/taxii/v2.1/taxii-v2.1.html", "publisher": "DOCS Oasis OPEN", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.oasis-open.org", "key": "publisher-domain:docs.oasis-open.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.opencti.io:ecd937b2b40a0b00", "title": "https://docs.opencti.io", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.opencti.io", "publisher": "DOCS Opencti", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.opencti.io", "key": "publisher-domain:docs.opencti.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs OpenCTI", "url": "https://1200km.com/adversarygraph-docs/comparisons/opencti/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:docs.securitytrails.com:253953102faa6494", "title": "https://docs.securitytrails.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.securitytrails.com", "publisher": "DOCS Securitytrails", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.securitytrails.com", "key": "publisher-domain:docs.securitytrails.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:eosgmbh.com:3b19797bde5c7614", "title": "https://eosgmbh.com/en/admiralty-code-for-the-verification-of-information", "description": "External source cited by 1 maintained 1200km page.", "url": "https://eosgmbh.com/en/admiralty-code-for-the-verification-of-information", "publisher": "Eosgmbh", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eosgmbh.com", "key": "publisher-domain:eosgmbh.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:fluentbit.io:2f27345d894e4c55", "title": "https://fluentbit.io/download", "description": "External source cited by 1 maintained 1200km page.", "url": "https://fluentbit.io/download", "publisher": "Fluentbit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fluentbit.io", "key": "publisher-domain:fluentbit.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Deploying Fluent Bit as a Windows Service for Centralized Log Forwarding", "url": "https://1200km.com/articles/read/2025/2025-11-02-deploying-fluent-bit-as-a-windows-service-for-centralized-log-forwarding-baec55b8aaf8/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:frida.re:f45f1ba572d38799", "title": "https://frida.re/docs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://frida.re/docs", "publisher": "Frida", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "frida.re", "key": "publisher-domain:frida.re" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:genai.owasp.org:6c204ba624117783", "title": "https://genai.owasp.org/llm-top-10", "description": "External source cited by 1 maintained 1200km page.", "url": "https://genai.owasp.org/llm-top-10", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.blog:289a3a8f5426419f", "title": "https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.blog", "key": "publisher-domain:github.blog" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:e79e04b79c8462f9", "title": "https://github.com/androguard/androguard", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/androguard/androguard", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:9140bbc2b5ed5430", "title": "https://github.com/anpa1200/adversarygraph/releases/tag/v2.5.0", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph/releases/tag/v2.5.0", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AdversaryGraph v2.5: New Name, New Release, Full AI CTI Platform Capability Map", "url": "https://1200km.com/articles/read/2026/2026-06-19-adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:e3bffb7abd44d40d", "title": "https://github.com/anpa1200/Passwords/tree/main", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/Passwords/tree/main", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Personal Pass Generator (PPG): The Ultimate Tool for Custom Password Lists", "url": "https://1200km.com/articles/read/2024/2024-10-20-personal-pass-generator-ppg-the-ultimate-tool-for-custom-password-lists-4979a3a1385c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:github.com:bcbbbaf423614400", "title": "https://github.com/aws/aws-for-fluent-bit", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/aws/aws-for-fluent-bit", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:github.com:8f0a15eeac92d858", "title": "https://github.com/BishopFox/sliver", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/BishopFox/sliver", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:5b660bef204cfd5f", "title": "https://github.com/BloodHoundAD/BloodHound", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/BloodHoundAD/BloodHound", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:9a98b92c86a3e89a", "title": "https://github.com/de4dot/de4dot", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/de4dot/de4dot", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "SPW AW25 — PO.010 SMS.exe.exe (AgentTesla)", "url": "https://1200km.com/articles/read/2025/2025-03-24-spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:068c9276a7cfeddf", "title": "https://github.com/digininja/DVWA", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/digininja/DVWA", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:github.com:d971bc27abd796f2", "title": "https://github.com/elastic/detection-rules", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/elastic/detection-rules", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:7a594581c974b2ee", "title": "https://github.com/fortra/impacket", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/fortra/impacket", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:004395b3fd61ba4b", "title": "https://github.com/kevoreilly/CAPEv2", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/kevoreilly/CAPEv2", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs Malware Sandboxes", "url": "https://1200km.com/adversarygraph-docs/comparisons/malware-sandboxes/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:8a3bcfb286943785", "title": "https://github.com/mitre-attack/attack-navigator", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/mitre-attack/attack-navigator", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs ATT&CK Navigator", "url": "https://1200km.com/adversarygraph-docs/comparisons/attack-navigator/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:github.com:6d4b591c0e57cf9d", "title": "https://github.com/MobSF/Mobile-Security-Framework-MobSF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:292ea1f7074a8f35", "title": "https://github.com/palantir/alerting-detection-strategy-framework", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/palantir/alerting-detection-strategy-framework", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:3ad5c71c1abf645d", "title": "https://github.com/projectdiscovery/subfinder", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/projectdiscovery/subfinder", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:307f4d552458e689", "title": "https://github.com/rednaga/APKiD", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/rednaga/APKiD", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:49fad3f4f688211d", "title": "https://github.com/salesforce/jarm", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/salesforce/jarm", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:1b9828350be9e4dc", "title": "https://github.com/sensepost/objection", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/sensepost/objection", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:16862db8d725025f", "title": "https://github.com/SigPloiter/SigPloit", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/SigPloiter/SigPloit", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:github.com:e0b146cefdaf8665", "title": "https://github.com/splunk/security_content", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/splunk/security_content", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:ict.org.il:5c75501950240646", "title": "https://ict.org.il/bibi-gate-handala-hack-team-a-mask-for-iranian-psychological-warfare", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ict.org.il/bibi-gate-handala-hack-team-a-mask-for-iranian-psychological-warfare", "publisher": "ICT ORG", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ict.org.il", "key": "publisher-domain:ict.org.il" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:ict.org.il:c477249076ae0d1c", "title": "https://ict.org.il/wp-content/uploads/2025/12/Download.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ict.org.il/wp-content/uploads/2025/12/Download.pdf", "publisher": "ICT ORG", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ict.org.il", "key": "publisher-domain:ict.org.il" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:infosecwriteups.com:631dd1c29dd5ad21", "title": "https://infosecwriteups.com/adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AdversaryGraph v2.5: New Name, New Release, Full AI CTI Platform Capability Map", "url": "https://1200km.com/articles/read/2026/2026-06-19-adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:infosecwriteups.com:ff9902751907ba5a", "title": "https://infosecwriteups.com/adversarygraph-v4-0-i-added-a-full-malware-analysis-workbench-to-my-self-hosted-cti-platform-8dfbf1db2c9e", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/adversarygraph-v4-0-i-added-a-full-malware-analysis-workbench-to-my-self-hosted-cti-platform-8dfbf1db2c9e", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "AdversaryGraph v4.0: I Added a Full Malware Analysis Workbench to My Self-Hosted CTI Platform", "url": "https://1200km.com/articles/read/2026/2026-06-26-adversarygraph-v4-0-i-added-a-full-malware-analysis-workbench-to-my-self-hosted-cti-platfo-8dfbf1db2c9e/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:infosecwriteups.com:b5bd096492c62d5c", "title": "https://infosecwriteups.com/adversarygraph-v5-0-from-cti-mapping-to-attack-simulation-and-siem-validation-21873b2a6c39", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/adversarygraph-v5-0-from-cti-mapping-to-attack-simulation-and-siem-validation-21873b2a6c39", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "AdversaryGraph v5.0: From CTI Mapping to Attack Simulation and SIEM Validation", "url": "https://1200km.com/articles/read/2026/2026-06-29-adversarygraph-v5-0-from-cti-mapping-to-attack-simulation-and-siem-validation-21873b2a6c39/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:infosecwriteups.com:e1b781ba574752e7", "title": "https://infosecwriteups.com/ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-and-data-foundations-2e26c0740a17", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-and-data-foundations-2e26c0740a17", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:infosecwriteups.com:245c3830d2b5d9f8", "title": "https://infosecwriteups.com/comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmware-8a151f8d5f1b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmware-8a151f8d5f1b", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:infosecwriteups.com:70b2851d66fa7d5a", "title": "https://infosecwriteups.com/cti-as-a-code-complete-step-by-step-methodology-dda5ef496a46", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/cti-as-a-code-complete-step-by-step-methodology-dda5ef496a46", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code: Complete Step-by-Step Methodology", "url": "https://1200km.com/articles/read/2026/2026-05-29-cti-as-a-code-complete-step-by-step-methodology-dda5ef496a46/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:infosecwriteups.com:8931c3cd48af0559", "title": "https://infosecwriteups.com/cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:infosecwriteups.com:e9a980354fa71e6b", "title": "https://infosecwriteups.com/newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:infosecwriteups.com:03716367d21efae7", "title": "https://infosecwriteups.com/operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:infosecwriteups.com:fcd87cd7f3df028a", "title": "https://infosecwriteups.com/the-intelligent-shield-057c9b4b9394", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/the-intelligent-shield-057c9b4b9394", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:infosecwriteups.com:84cd12b89f6af1cd", "title": "https://infosecwriteups.com/threatmapper-i-built-a-self-hosted-ai-threat-intelligence-platform-heres-how-to-use-it-0aa7673e6bd8", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/threatmapper-i-built-a-self-hosted-ai-threat-intelligence-platform-heres-how-to-use-it-0aa7673e6bd8", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AdversaryGraph: I Built a Self-Hosted AI Threat Intelligence Platform — Here’s How to Use It", "url": "https://1200km.com/articles/read/2026/2026-06-07-adversarygraph-i-built-a-self-hosted-ai-threat-intelligence-platform-here-s-how-to-use-it-0aa7673e6bd8/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:infosecwriteups.com:f246597ee4534b0f", "title": "https://infosecwriteups.com/threatmapper-v2-0-i-built-a-self-hosted-ai-threat-intelligence-platform-941a80cc5a65", "description": "External source cited by 1 maintained 1200km page.", "url": "https://infosecwriteups.com/threatmapper-v2-0-i-built-a-self-hosted-ai-threat-intelligence-platform-941a80cc5a65", "publisher": "Infosecwriteups", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecwriteups.com", "key": "publisher-domain:infosecwriteups.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AdversaryGraph v2.0: I Built a Self-Hosted AI Threat Intelligence Platform", "url": "https://1200km.com/articles/read/2026/2026-06-16-adversarygraph-v2-0-i-built-a-self-hosted-ai-threat-intelligence-platform-941a80cc5a65/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:irancybernews.org:f0fc4dccbae9cfe8", "title": "https://irancybernews.org/en/handala-hacking-group-exposes-confidential-access-to-suvarnabhumi-airport", "description": "External source cited by 1 maintained 1200km page.", "url": "https://irancybernews.org/en/handala-hacking-group-exposes-confidential-access-to-suvarnabhumi-airport", "publisher": "Irancybernews", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "irancybernews.org", "key": "publisher-domain:irancybernews.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:juice-shop.herokuapp.com:1e866dc541f93688", "title": "https://juice-shop.herokuapp.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://juice-shop.herokuapp.com", "publisher": "Juice SHOP Herokuapp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "juice-shop.herokuapp.com", "key": "publisher-domain:juice-shop.herokuapp.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Unlocking Web Intelligence: A Deep Dive into WhatWeb", "url": "https://1200km.com/articles/read/2024/2024-11-10-unlocking-web-intelligence-a-deep-dive-into-whatweb-8ee4e64ce411/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:kubernetes.io:a8e1d91fc811bc86", "title": "https://kubernetes.io/docs/concepts/configuration/configmap", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/concepts/configuration/configmap", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:kubernetes.io:b40c7788e73fe7bb", "title": "https://kubernetes.io/docs/concepts/workloads/controllers/daemonset", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://kubernetes.io/docs/concepts/workloads/controllers/daemonset", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" }, { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:kubernetes.io:1ac4c3f88091bc62", "title": "https://kubernetes.io/docs/reference/kubectl", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/reference/kubectl", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:learn.microsoft.com:b4b56247abb506ae", "title": "https://learn.microsoft.com/en-us/azure/sentinel/fusion", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/azure/sentinel/fusion", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:learn.microsoft.com:91ff6f2fa082d1b2", "title": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-service-principal-sign-ins", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-service-principal-sign-ins", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:learn.microsoft.com:ca079c06e1ac787f", "title": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:learn.microsoft.com:93666ce13f934764", "title": "https://learn.microsoft.com/entra/id-protection/concept-identity-protection-risks", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/entra/id-protection/concept-identity-protection-risks", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:logging.apache.org:3a6e0ee8add06bc7", "title": "https://logging.apache.org/log4j/2.x/security.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://logging.apache.org/log4j/2.x/security.html", "publisher": "Logging Apache", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "logging.apache.org", "key": "publisher-domain:logging.apache.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:lolbas-project.github.io:d74a2327c1b0555f", "title": "https://lolbas-project.github.io/lolbas/Binaries/Certutil", "description": "External source cited by 1 maintained 1200km page.", "url": "https://lolbas-project.github.io/lolbas/Binaries/Certutil", "publisher": "Lolbas Project Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "lolbas-project.github.io", "key": "publisher-domain:lolbas-project.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:lolbas-project.github.io:6fb71923ee730856", "title": "https://lolbas-project.github.io/lolbas/Libraries/Comsvcs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://lolbas-project.github.io/lolbas/Libraries/Comsvcs", "publisher": "Lolbas Project Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "lolbas-project.github.io", "key": "publisher-domain:lolbas-project.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:814fff0e731a1858", "title": "https://medium.com/@1200km/2john-9bb0bd44ed64", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/2john-9bb0bd44ed64", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "2John", "url": "https://1200km.com/articles/read/2024/2024-11-15-2john-9bb0bd44ed64/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:a8a3ab6544ed699b", "title": "https://medium.com/@1200km/a-complete-cloud-penetration-testing-walkthrough-1914f687d7fd", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/a-complete-cloud-penetration-testing-walkthrough-1914f687d7fd", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "A Complete Cloud Penetration Testing Walkthrough", "url": "https://1200km.com/articles/read/2026/2026-01-31-a-complete-cloud-penetration-testing-walkthrough-1914f687d7fd/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:756c125e7526d345", "title": "https://medium.com/@1200km/a-practical-guide-to-string-analyzer-extract-and-analyze-strings-from-binaries-without-the-875dc74e4868", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/a-practical-guide-to-string-analyzer-extract-and-analyze-strings-from-binaries-without-the-875dc74e4868", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "A Practical Guide to String Analyzer: Extract and Analyze Strings from Binaries (Without the…", "url": "https://1200km.com/articles/read/2026/2026-02-26-a-practical-guide-to-string-analyzer-extract-and-analyze-strings-from-binaries-without-the-875dc74e4868/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:4b271255992a7cdd", "title": "https://medium.com/@1200km/accessing-remote-desktops-a-beginner-s-guide-to-rdp-cracking-with-crowbar-and-ppg-tools-5f50027115b7", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/accessing-remote-desktops-a-beginner-s-guide-to-rdp-cracking-with-crowbar-and-ppg-tools-5f50027115b7", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Accessing Remote Desktops: A Beginner’s Guide to RDP Cracking with Crowbar and PPG tools", "url": "https://1200km.com/articles/read/2024/2024-10-20-accessing-remote-desktops-a-beginner-s-guide-to-rdp-cracking-with-crowbar-and-ppg-tools-5f50027115b7/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:6d7d9597ff484bd6", "title": "https://medium.com/@1200km/active-directory-lab-for-pentest-manual-deployment-guide-cab28cd4ad8d", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/active-directory-lab-for-pentest-manual-deployment-guide-cab28cd4ad8d", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Active Directory Lab for PenTest. Manual Deployment Guide", "url": "https://1200km.com/articles/read/2026/2026-01-24-active-directory-lab-for-pentest-manual-deployment-guide-cab28cd4ad8d/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:medium.com:129df90b57bed921", "title": "https://medium.com/@1200km/active-directory-penetration-testing-745cfb31d7d3", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/active-directory-penetration-testing-745cfb31d7d3", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Active Directory Penetration Testing", "url": "https://1200km.com/articles/read/2026/2026-01-26-active-directory-penetration-testing-745cfb31d7d3/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:medium.com:dd43c013c6fd3793", "title": "https://medium.com/@1200km/adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "ADCS ESC8 Attack: Certificate-Based Domain Compromise — Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-01-28-adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:6eeba4066d04cb1c", "title": "https://medium.com/@1200km/adversarygraph-40df3439b90c", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/adversarygraph-40df3439b90c", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "AdversaryGraph", "url": "https://1200km.com/articles/read/2026/2026-07-23-adversarygraph-40df3439b90c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:04404a93af8ff09d", "title": "https://medium.com/@1200km/ai-assisted-web-and-cloud-penetration-testing-with-cursor-mcp-hexstrike-and-burp-suite-mcp-01c02eed5258", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-assisted-web-and-cloud-penetration-testing-with-cursor-mcp-hexstrike-and-burp-suite-mcp-01c02eed5258", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "AI-Assisted Web and Cloud Penetration Testing with Cursor + MCP HexStrike and Burp Suite MCP.", "url": "https://1200km.com/articles/read/2026/2026-01-31-ai-assisted-web-and-cloud-penetration-testing-with-cursor-mcp-hexstrike-and-burp-suite-mcp-01c02eed5258/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:885fe62f28a9a0f5", "title": "https://medium.com/@1200km/ai-driven-black-box-active-directory-penetration-testing-8de0b9ad38b7", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-driven-black-box-active-directory-penetration-testing-8de0b9ad38b7", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "AI-Driven Black Box Active Directory Penetration Testing", "url": "https://1200km.com/articles/read/2026/2026-01-27-ai-driven-black-box-active-directory-penetration-testing-8de0b9ad38b7/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:medium.com:3c0b7e02226b8efe", "title": "https://medium.com/@1200km/ai-driven-office-documents-password-recovery-with-hexstrike-ai-and-gemini-cli-3c8bb7deb82d", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-driven-office-documents-password-recovery-with-hexstrike-ai-and-gemini-cli-3c8bb7deb82d", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI-Driven Office Documents Password Recovery with HexStrike-AI and Gemini-CLI", "url": "https://1200km.com/articles/read/2025/2025-12-29-ai-driven-office-documents-password-recovery-with-hexstrike-ai-and-gemini-cli-3c8bb7deb82d/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:48dc959f78276fd7", "title": "https://medium.com/@1200km/ai-driven-pdf-password-recovery-with-hexstrike-ai-and-gemini-cli-cfa7eb0fae91", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-driven-pdf-password-recovery-with-hexstrike-ai-and-gemini-cli-cfa7eb0fae91", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI-Driven PDF Password Recovery with HexStrike-AI and Gemini-CLI", "url": "https://1200km.com/articles/read/2025/2025-12-29-ai-driven-pdf-password-recovery-with-hexstrike-ai-and-gemini-cli-cfa7eb0fae91/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:41b5ac679a44ac91", "title": "https://medium.com/@1200km/ai-driven-pentesting-at-home-using-hexstrike-ai-for-full-network-discovery-and-exploitatio-00a9e88b3bde", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-driven-pentesting-at-home-using-hexstrike-ai-for-full-network-discovery-and-exploitatio-00a9e88b3bde", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI-Driven Pentesting at Home: Using HexStrike-AI for Full Network Discovery and Exploitation", "url": "https://1200km.com/articles/read/2025/2025-12-21-ai-driven-pentesting-at-home-using-hexstrike-ai-for-full-network-discovery-and-exploitatio-00a9e88b3bde/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:b5f3a583981285dc", "title": "https://medium.com/@1200km/ai-driven-web-application-pentesting-with-hexstrike-ai-67f3dae32040", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-driven-web-application-pentesting-with-hexstrike-ai-67f3dae32040", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI-Driven Web Application Pentesting with HexStrike-AI", "url": "https://1200km.com/articles/read/2025/2025-12-22-ai-driven-web-application-pentesting-with-hexstrike-ai-67f3dae32040/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:bd52ea73b420946b", "title": "https://medium.com/@1200km/ai-driven-wireless-penetration-testing-one-promt-wifi-cracking-6477c06f6af4", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-driven-wireless-penetration-testing-one-promt-wifi-cracking-6477c06f6af4", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI-Driven Wireless Penetration Testing. One Promt WIFI cracking", "url": "https://1200km.com/articles/read/2025/2025-12-24-ai-driven-wireless-penetration-testing-one-promt-wifi-cracking-6477c06f6af4/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:9f9a42145d96484b", "title": "https://medium.com/@1200km/ai-driven-zip-password-recovery-with-hexstrike-ai-and-gemini-cli-b8fc5c475ebc", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-driven-zip-password-recovery-with-hexstrike-ai-and-gemini-cli-b8fc5c475ebc", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI-Driven ZIP Password Recovery with HexStrike-AI and Gemini-CLI", "url": "https://1200km.com/articles/read/2025/2025-12-25-ai-driven-zip-password-recovery-with-hexstrike-ai-and-gemini-cli-b8fc5c475ebc/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:b466dd9cdbc26fff", "title": "https://medium.com/@1200km/ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:c67e898db87f21ee", "title": "https://medium.com/@1200km/ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:6a4edc02935292c6", "title": "https://medium.com/@1200km/ai-powered-malware-debugger-that-explains-every-function-it-sees-2a28ef75df8a", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-powered-malware-debugger-that-explains-every-function-it-sees-2a28ef75df8a", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "AI-Powered Malware Debugger That Explains Every Function It Sees", "url": "https://1200km.com/articles/read/2026/2026-03-14-ai-powered-malware-debugger-that-explains-every-function-it-sees-2a28ef75df8a/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:41ee0453e3a1095f", "title": "https://medium.com/@1200km/android-apk-analysis-tool-ai-powered-static-malware-analysis-in-your-terminal-4beb239dad12", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/android-apk-analysis-tool-ai-powered-static-malware-analysis-in-your-terminal-4beb239dad12", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android APK Analysis Tool: AI-Powered Static Malware Analysis in Your Terminal", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-apk-analysis-tool-ai-powered-static-malware-analysis-in-your-terminal-4beb239dad12/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:a7ee049e3650f044", "title": "https://medium.com/@1200km/android-apk-vulnerability-research-complete-guide-a8fcae0f4849", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/android-apk-vulnerability-research-complete-guide-a8fcae0f4849", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Android APK Vulnerability Research Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-04-08-android-apk-vulnerability-research-complete-guide-a8fcae0f4849/", "type": "article", "domain": "vulnerability-research" } ] }, { "id": "site-reference:medium.com:c24cab465200b98e", "title": "https://medium.com/@1200km/android-emulation-and-virtualisation-2f6b33fcc4aa", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/android-emulation-and-virtualisation-2f6b33fcc4aa", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Android Emulation & Virtualisation", "url": "https://1200km.com/articles/read/2026/2026-04-07-android-emulation-and-virtualisation-2f6b33fcc4aa/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:medium.com:d6d7b2ae474f9e05", "title": "https://medium.com/@1200km/android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:e079e98e9184eacf", "title": "https://medium.com/@1200km/applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:b5dd56475265ab7d", "title": "https://medium.com/@1200km/apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:3fc5e86427b248a1", "title": "https://medium.com/@1200km/att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:medium.com:8c0390d5c45cabc1", "title": "https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Attack Playbook — Operation DragonRx", "url": "https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:ec623ed477092705", "title": "https://medium.com/@1200km/attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Attribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution", "url": "https://1200km.com/articles/read/2026/2026-03-20-attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:d5ec23be62d27ca5", "title": "https://medium.com/@1200km/augmenting-digital-forensics-with-ai-how-chatgpt-transforms-investigation-workflows-34eb10887ea5", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/augmenting-digital-forensics-with-ai-how-chatgpt-transforms-investigation-workflows-34eb10887ea5", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "Augmenting Digital Forensics with AI: How ChatGPT Transforms Investigation Workflows", "url": "https://1200km.com/articles/read/2025/2025-10-19-augmenting-digital-forensics-with-ai-how-chatgpt-transforms-investigation-workflows-34eb10887ea5/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:b2918736224aafe2", "title": "https://medium.com/@1200km/authenticator-exe-dearsteeler-0c1d69767939", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/authenticator-exe-dearsteeler-0c1d69767939", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:90f03ee6e8c9993d", "title": "https://medium.com/@1200km/automating-a-safe-dvwa-lab-with-ansible-build-a-reproducible-vulnerable-environment-for-tr-026d74697c4a", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/automating-a-safe-dvwa-lab-with-ansible-build-a-reproducible-vulnerable-environment-for-tr-026d74697c4a", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Automating a Safe DVWA Lab with Ansible: Build a Reproducible Vulnerable Environment for Training…", "url": "https://1200km.com/articles/read/2025/2025-10-18-automating-a-safe-dvwa-lab-with-ansible-build-a-reproducible-vulnerable-environment-for-tr-026d74697c4a/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:83350a106b868f30", "title": "https://medium.com/@1200km/basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Basic Static Malware Analysis: From Triage to Unpacking — Explained and Automated", "url": "https://1200km.com/articles/read/2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:6221c413bc06e342", "title": "https://medium.com/@1200km/black-box-kubernetes-penetration-testing-playbook-56350b178af4", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/black-box-kubernetes-penetration-testing-playbook-56350b178af4", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Black-Box Kubernetes Penetration Testing Playbook", "url": "https://1200km.com/articles/read/2026/2026-02-03-black-box-kubernetes-penetration-testing-playbook-56350b178af4/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:83e5e4e50bcc8839", "title": "https://medium.com/@1200km/breaking-the-code-how-to-use-hashcat-for-effective-password-cracking-15f8da8facb8", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/breaking-the-code-how-to-use-hashcat-for-effective-password-cracking-15f8da8facb8", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Breaking the Code: How to Use Hashcat for Effective Password Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-03-breaking-the-code-how-to-use-hashcat-for-effective-password-cracking-15f8da8facb8/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:07c9b0a14cc4f75f", "title": "https://medium.com/@1200km/build-a-vulnerable-iis-sharepoint-lab-with-fluent-bit-complete-deployment-guide-8fe947e8439e", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/build-a-vulnerable-iis-sharepoint-lab-with-fluent-bit-complete-deployment-guide-8fe947e8439e", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Build a Vulnerable IIS SharePoint Lab with Fluent Bit: Complete Deployment Guide", "url": "https://1200km.com/articles/read/2026/2026-02-13-build-a-vulnerable-iis-sharepoint-lab-with-fluent-bit-complete-deployment-guide-8fe947e8439e/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:5e13130102acf506", "title": "https://medium.com/@1200km/building-a-dockerized-ai-powered-host-vulnerability-assessment-tool-cd6e2147ce59", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/building-a-dockerized-ai-powered-host-vulnerability-assessment-tool-cd6e2147ce59", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "Building a Dockerized AI-Powered Host Vulnerability Assessment Tool", "url": "https://1200km.com/articles/read/2026/2026-03-11-building-a-dockerized-ai-powered-host-vulnerability-assessment-tool-cd6e2147ce59/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:2bc42ab373b47093", "title": "https://medium.com/@1200km/building-a-usb-rubber-ducky-with-arduino-leonardo-with-cursor-a23dd64d1bbe", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/building-a-usb-rubber-ducky-with-arduino-leonardo-with-cursor-a23dd64d1bbe", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Building a USB Rubber Ducky with Arduino Leonardo with Cursor.", "url": "https://1200km.com/articles/read/2026/2026-01-15-building-a-usb-rubber-ducky-with-arduino-leonardo-with-cursor-a23dd64d1bbe/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:e032d1ffedb91bde", "title": "https://medium.com/@1200km/building-a-vulnerable-cloud-pentest-lab-with-terraform-9858ac96b29e", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/building-a-vulnerable-cloud-pentest-lab-with-terraform-9858ac96b29e", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable Cloud Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-03-13-building-a-vulnerable-cloud-pentest-lab-with-terraform-9858ac96b29e/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:92d30b4bd0644392", "title": "https://medium.com/@1200km/building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:955aab5134d24d33", "title": "https://medium.com/@1200km/building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable Kubernetes Lab: A Complete Guide to 25 Critical Security Issues", "url": "https://1200km.com/articles/read/2026/2026-02-02-building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:5538a0f817d5718f", "title": "https://medium.com/@1200km/building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:8e3477dd14d923f6", "title": "https://medium.com/@1200km/building-an-extremely-vulnerable-ubuntu-24-04-server-lab-bonus-full-pt-with-hexstrike-90034032775b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/building-an-extremely-vulnerable-ubuntu-24-04-server-lab-bonus-full-pt-with-hexstrike-90034032775b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Building an Extremely Vulnerable Ubuntu 24.04 Server Lab (Bonus: Full PT with Hexstrike)", "url": "https://1200km.com/articles/read/2026/2026-01-06-building-an-extremely-vulnerable-ubuntu-24-04-server-lab-bonus-full-pt-with-hexstrike-90034032775b/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:8fb5072016981207", "title": "https://medium.com/@1200km/building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Building an Extremely Vulnerable Windows 10 Lab: A Step-by-Step Guide (Bonus :Full PT with…", "url": "https://1200km.com/articles/read/2026/2026-01-05-building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:33e5108f6103f3d2", "title": "https://medium.com/@1200km/burp-suite-mcp-gemini-cli-c1229edfe092", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/burp-suite-mcp-gemini-cli-c1229edfe092", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Burp Suite MCP + Gemini CLI", "url": "https://1200km.com/articles/read/2026/2026-01-02-burp-suite-mcp-gemini-cli-c1229edfe092/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:55386d251526f4cc", "title": "https://medium.com/@1200km/censys-for-enhanced-cybersecurity-insight-533df14794bd", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/censys-for-enhanced-cybersecurity-insight-533df14794bd", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Censys for Enhanced Cybersecurity Insight", "url": "https://1200km.com/articles/read/2024/2024-11-10-censys-for-enhanced-cybersecurity-insight-533df14794bd/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:ecb06ebcde3e3ab6", "title": "https://medium.com/@1200km/cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:135cb94a8b029482", "title": "https://medium.com/@1200km/correlation-based-detection-rules-in-cybersecurity-from-atomic-events-to-behavioral-insigh-1b3df31597bb", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/correlation-based-detection-rules-in-cybersecurity-from-atomic-events-to-behavioral-insigh-1b3df31597bb", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Correlation-Based Detection Rules in Cybersecurity: From Atomic Events to Behavioral Insight", "url": "https://1200km.com/articles/read/2025/2025-12-02-correlation-based-detection-rules-in-cybersecurity-from-atomic-events-to-behavioral-insigh-1b3df31597bb/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:718042bb242b7c26", "title": "https://medium.com/@1200km/correlation-based-detection-rules-in-cybersecurity-from-atomic-events-to-behavioral-insight-1b3df31597bb", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/correlation-based-detection-rules-in-cybersecurity-from-atomic-events-to-behavioral-insight-1b3df31597bb", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:981d10068d7282db", "title": "https://medium.com/@1200km/cracking-rtsp-security-a-comprehensive-guide-to-using-the-rtsp-brute-force-tool-ad1c29b9e5ee", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cracking-rtsp-security-a-comprehensive-guide-to-using-the-rtsp-brute-force-tool-ad1c29b9e5ee", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Cracking RTSP Security: A Comprehensive Guide to Using the RTSP Brute Force Tool", "url": "https://1200km.com/articles/read/2024/2024-10-23-cracking-rtsp-security-a-comprehensive-guide-to-using-the-rtsp-brute-force-tool-ad1c29b9e5ee/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:5366fb0093a98617", "title": "https://medium.com/@1200km/cracking-ssh-with-metasploit-a-step-by-step-guide-to-exploiting-weak-credentials-3ec6ef4cee5b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cracking-ssh-with-metasploit-a-step-by-step-guide-to-exploiting-weak-credentials-3ec6ef4cee5b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Cracking SSH with Metasploit: A Step-by-Step Guide to Exploiting Weak Credentials", "url": "https://1200km.com/articles/read/2024/2024-10-23-cracking-ssh-with-metasploit-a-step-by-step-guide-to-exploiting-weak-credentials-3ec6ef4cee5b/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:13c4d282007116dd", "title": "https://medium.com/@1200km/cracking-telnet-exploring-weaknesses-and-exploitation-techniques-af5d743abb09", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cracking-telnet-exploring-weaknesses-and-exploitation-techniques-af5d743abb09", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Cracking Telnet: Exploring Weaknesses and Exploitation Techniques", "url": "https://1200km.com/articles/read/2024/2024-10-22-cracking-telnet-exploring-weaknesses-and-exploitation-techniques-af5d743abb09/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:0dfeccbdaa6ade1c", "title": "https://medium.com/@1200km/cracking-web-interfaces-with-burp-suite-a-comprehensive-tutorial-33087bb286b0", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cracking-web-interfaces-with-burp-suite-a-comprehensive-tutorial-33087bb286b0", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Cracking Web Interfaces with Burp Suite: A Comprehensive Tutorial", "url": "https://1200km.com/articles/read/2024/2024-10-24-cracking-web-interfaces-with-burp-suite-a-comprehensive-tutorial-33087bb286b0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:b2cc97bccc6e716c", "title": "https://medium.com/@1200km/cti-analyst-field-manual-complete-reference-ef2a370bb21f", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cti-analyst-field-manual-complete-reference-ef2a370bb21f", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Analyst Field Manual — Complete Reference", "url": "https://1200km.com/articles/read/2026/2026-05-18-cti-analyst-field-manual-complete-reference-ef2a370bb21f/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:c6d4b689ded51338", "title": "https://medium.com/@1200km/cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:066e41de8ecf8a34", "title": "https://medium.com/@1200km/cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:96657b75fec188b8", "title": "https://medium.com/@1200km/cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:d0a3b7a3d32ce882", "title": "https://medium.com/@1200km/cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:fc2b0d807a9f1ee3", "title": "https://medium.com/@1200km/cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:6a4def16e7cbe299", "title": "https://medium.com/@1200km/cti-research-sandworm-apt44-649332e8af44", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cti-research-sandworm-apt44-649332e8af44", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:e219f24e7f1fb516", "title": "https://medium.com/@1200km/cursor-hexstrike-fully-automated-adcs-esc8-attack-8736fec53c58", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cursor-hexstrike-fully-automated-adcs-esc8-attack-8736fec53c58", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Cursor + Hexstrike. Fully Automated ADCS ESC8 Attack", "url": "https://1200km.com/articles/read/2026/2026-01-29-cursor-hexstrike-fully-automated-adcs-esc8-attack-8736fec53c58/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:9d70553db4094081", "title": "https://medium.com/@1200km/customer-driven-ai-cti-project-c0db3cdc1830", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/customer-driven-ai-cti-project-c0db3cdc1830", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project", "url": "https://1200km.com/articles/read/2026/2026-05-13-customer-driven-ai-cti-project-c0db3cdc1830/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:94ab87ad6051f26a", "title": "https://medium.com/@1200km/customer-driven-ai-cti-project-template-part-1-foundations-745861507d03", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/customer-driven-ai-cti-project-template-part-1-foundations-745861507d03", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:3496f6a143ee5aac", "title": "https://medium.com/@1200km/customer-driven-ai-cti-project-template-part-2a-phase-by-phase-execution-guide-f9751a8bcb59", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/customer-driven-ai-cti-project-template-part-2a-phase-by-phase-execution-guide-f9751a8bcb59", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 2A: Phase-by-Phase Execution Guide", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2a-phase-by-phase-execution-guide-f9751a8bcb59/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:823a24e596e97cee", "title": "https://medium.com/@1200km/customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:2754a55e5c49a018", "title": "https://medium.com/@1200km/cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:db7bdd9d93d302ea", "title": "https://medium.com/@1200km/cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:medium.com:0951b8234e6c1a3e", "title": "https://medium.com/@1200km/cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:medium.com:019dacf7b6ce65f2", "title": "https://medium.com/@1200km/deep-dive-automating-static-malware-analysis-with-three-python-tools-46a26c0a7f87", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/deep-dive-automating-static-malware-analysis-with-three-python-tools-46a26c0a7f87", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Deep Dive: Automating Static Malware Analysis with Three Python Tools", "url": "https://1200km.com/articles/read/2025/2025-04-17-deep-dive-automating-static-malware-analysis-with-three-python-tools-46a26c0a7f87/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:92f078b28ee53f54", "title": "https://medium.com/@1200km/deliberately-vulnerable-android-app-covering-every-owasp-mobile-top-10-class-7be775fc6415", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/deliberately-vulnerable-android-app-covering-every-owasp-mobile-top-10-class-7be775fc6415", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Deliberately Vulnerable Android App Covering Every OWASP Mobile Top 10 Class", "url": "https://1200km.com/articles/read/2026/2026-04-08-deliberately-vulnerable-android-app-covering-every-owasp-mobile-top-10-class-7be775fc6415/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:medium.com:9cead73f3a35391d", "title": "https://medium.com/@1200km/deploy-a-complete-active-directory-pentest-lab-in-one-prompt-with-cursor-ai-ff926fd2b3fc", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/deploy-a-complete-active-directory-pentest-lab-in-one-prompt-with-cursor-ai-ff926fd2b3fc", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Deploy a Complete Active Directory PenTest Lab in One Prompt with Cursor AI", "url": "https://1200km.com/articles/read/2026/2026-01-23-deploy-a-complete-active-directory-pentest-lab-in-one-prompt-with-cursor-ai-ff926fd2b3fc/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:medium.com:cb56803b7c69591b", "title": "https://medium.com/@1200km/deploying-fluent-bit-as-a-windows-service-for-centralized-log-forwarding-baec55b8aaf8", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/deploying-fluent-bit-as-a-windows-service-for-centralized-log-forwarding-baec55b8aaf8", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Deploying Fluent Bit as a Windows Service for Centralized Log Forwarding", "url": "https://1200km.com/articles/read/2025/2025-11-02-deploying-fluent-bit-as-a-windows-service-for-centralized-log-forwarding-baec55b8aaf8/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:medium.com:02b9b3a1fcb6b0eb", "title": "https://medium.com/@1200km/endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "Endpoint Threat Hunting: Proactive Detection on Windows, Linux, and macOS", "url": "https://1200km.com/articles/read/2025/2025-12-14-endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:medium.com:2e248bd53b74351f", "title": "https://medium.com/@1200km/enhancing-penetration-testing-with-hackerai-step-by-step-guide-metasploitable-lab-b2ab2cdd4139", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/enhancing-penetration-testing-with-hackerai-step-by-step-guide-metasploitable-lab-b2ab2cdd4139", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Enhancing Penetration Testing with HackerAI: Step-by-Step Guide (Metasploitable Lab)", "url": "https://1200km.com/articles/read/2025/2025-11-26-enhancing-penetration-testing-with-hackerai-step-by-step-guide-metasploitable-lab-b2ab2cdd4139/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:e756aff90a9ca7e1", "title": "https://medium.com/@1200km/exploiting-ftp-vulnerabilities-for-effective-penetration-testing-a2810df78602", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/exploiting-ftp-vulnerabilities-for-effective-penetration-testing-a2810df78602", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Exploiting FTP Vulnerabilities for Effective Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-10-21-exploiting-ftp-vulnerabilities-for-effective-penetration-testing-a2810df78602/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:6f60c9026c429577", "title": "https://medium.com/@1200km/fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:medium.com:2982c022b24e4337", "title": "https://medium.com/@1200km/fluentbit-on-kubernetes-demonset-deployment-13c3915113ba", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/fluentbit-on-kubernetes-demonset-deployment-13c3915113ba", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:6fd455f819266616", "title": "https://medium.com/@1200km/from-bugs-to-breaches-learning-secure-coding-through-the-owasp-top-10-21b425fafb83", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/from-bugs-to-breaches-learning-secure-coding-through-the-owasp-top-10-21b425fafb83", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "From Bugs to Breaches: Learning Secure Coding Through the OWASP Top 10", "url": "https://1200km.com/articles/read/2025/2025-08-31-from-bugs-to-breaches-learning-secure-coding-through-the-owasp-top-10-21b425fafb83/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:3e598f084e641ca7", "title": "https://medium.com/@1200km/from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:9dff036fe9cdbbec", "title": "https://medium.com/@1200km/gcp-penetration-testing-a-step-by-step-attack-guide-9e39bc3eb96d", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/gcp-penetration-testing-a-step-by-step-attack-guide-9e39bc3eb96d", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "GCP Penetration Testing: A Step-by-Step Attack Guide", "url": "https://1200km.com/articles/read/2026/2026-02-09-gcp-penetration-testing-a-step-by-step-attack-guide-9e39bc3eb96d/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:39b21e5d3ee2112c", "title": "https://medium.com/@1200km/getting-more-from-burp-suite-with-llms-fdd03cec343d", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/getting-more-from-burp-suite-with-llms-fdd03cec343d", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Getting More from Burp Suite with LLMs", "url": "https://1200km.com/articles/read/2025/2025-11-25-getting-more-from-burp-suite-with-llms-fdd03cec343d/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:9a63fb69e00c183d", "title": "https://medium.com/@1200km/hacker-tool-development-workflow-android-rubber-ducky-payloads-in-cursor-ai-47fcccb9c845", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hacker-tool-development-workflow-android-rubber-ducky-payloads-in-cursor-ai-47fcccb9c845", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "Hacker Tool Development Workflow: Android Rubber Ducky Payloads in Cursor AI", "url": "https://1200km.com/articles/read/2026/2026-01-16-hacker-tool-development-workflow-android-rubber-ducky-payloads-in-cursor-ai-47fcccb9c845/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:5079e78a0c736729", "title": "https://medium.com/@1200km/hexstrike-ai-a-force-multiplier-for-red-teams-and-a-dangerous-shift-in-the-threat-landscap-3e1d4e86f3ae", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hexstrike-ai-a-force-multiplier-for-red-teams-and-a-dangerous-shift-in-the-threat-landscap-3e1d4e86f3ae", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike-AI: A Force Multiplier for Red Teams — and a Dangerous Shift in the Threat Landscape", "url": "https://1200km.com/articles/read/2025/2025-12-25-hexstrike-ai-a-force-multiplier-for-red-teams-and-a-dangerous-shift-in-the-threat-landscap-3e1d4e86f3ae/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:f4c50d9ecca27996", "title": "https://medium.com/@1200km/hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike AI: Install, Configure, and Run MCP with Gemini, OpenAI, Cursor, Llama", "url": "https://1200km.com/articles/read/2025/2025-12-18-hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:d3c9ca02f3a1aa74", "title": "https://medium.com/@1200km/hexstrike-cursor-for-osint-from-one-email-to-a-full-exposure-map-ffdfc7ba1b30", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hexstrike-cursor-for-osint-from-one-email-to-a-full-exposure-map-ffdfc7ba1b30", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" } ], "used_in": [ { "title": "HexStrike + Cursor for OSINT: From One Email to a Full Exposure Map", "url": "https://1200km.com/articles/read/2026/2026-01-11-hexstrike-cursor-for-osint-from-one-email-to-a-full-exposure-map-ffdfc7ba1b30/", "type": "article", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:medium.com:3d42b8c7edbdec8e", "title": "https://medium.com/@1200km/hexstrike-cursor-mcp-from-single-target-full-subnet-compromise-lab-pt-walkthrough-f2e1fd793ad7", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hexstrike-cursor-mcp-from-single-target-full-subnet-compromise-lab-pt-walkthrough-f2e1fd793ad7", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike + Cursor (MCP): From Single Target → Full Subnet Compromise (Lab PT Walkthrough)", "url": "https://1200km.com/articles/read/2026/2026-01-08-hexstrike-cursor-mcp-from-single-target-full-subnet-compromise-lab-pt-walkthrough-f2e1fd793ad7/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:dbe05a0a4a2d9eb4", "title": "https://medium.com/@1200km/hexstrike-gemini-ai-assisted-smb-exposure-credential-brute-force-2c5f99dcdbf4", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hexstrike-gemini-ai-assisted-smb-exposure-credential-brute-force-2c5f99dcdbf4", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike + Gemini. AI-Assisted SMB Exposure Credential Brute-Force", "url": "https://1200km.com/articles/read/2026/2026-01-05-hexstrike-gemini-ai-assisted-smb-exposure-credential-brute-force-2c5f99dcdbf4/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:10750be2043690d1", "title": "https://medium.com/@1200km/hexstrike-gemini-ai-assisted-ssh-credential-brute-force-a9162f8e253b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hexstrike-gemini-ai-assisted-ssh-credential-brute-force-a9162f8e253b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike + Gemini. AI-Assisted SSH Credential Brute-Force", "url": "https://1200km.com/articles/read/2026/2026-01-04-hexstrike-gemini-ai-assisted-ssh-credential-brute-force-a9162f8e253b/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:019f5645b369cfee", "title": "https://medium.com/@1200km/hexstrike-gemini-vs-hackerai-ops-copilot-vs-chatbot-with-tools-1d799845410b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hexstrike-gemini-vs-hackerai-ops-copilot-vs-chatbot-with-tools-1d799845410b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike + Gemini vs. HackerAI: “Ops Copilot” vs. “Chatbot with Tools”", "url": "https://1200km.com/articles/read/2025/2025-12-26-hexstrike-gemini-vs-hackerai-ops-copilot-vs-chatbot-with-tools-1d799845410b/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:39273b2f7969b54e", "title": "https://medium.com/@1200km/hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike MCP Orchestration with Ollama: Ubuntu Host, Kali VM, SSH Bridging, and Performance…", "url": "https://1200km.com/articles/read/2025/2025-12-31-hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:41ddc258d0c3e8f3", "title": "https://medium.com/@1200km/hexstrike-openai-codex-ai-driven-exploitation-of-metasploitable-b892c07be39f", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hexstrike-openai-codex-ai-driven-exploitation-of-metasploitable-b892c07be39f", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike+OpenAI Codex. AI-Driven Exploitation of Metasploitable.", "url": "https://1200km.com/articles/read/2026/2026-01-03-hexstrike-openai-codex-ai-driven-exploitation-of-metasploitable-b892c07be39f/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:18298cea3fa09158", "title": "https://medium.com/@1200km/hi-two-of-my-articles-have-been-in-pending-status-for-the-past-few-days-cac7ab7d9191", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/hi-two-of-my-articles-have-been-in-pending-status-for-the-past-few-days-cac7ab7d9191", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Hi! Two of my articles have been in pending status for the past few days.", "url": "https://1200km.com/articles/read/2026/2026-01-25-hi-two-of-my-articles-have-been-in-pending-status-for-the-past-few-days-cac7ab7d9191/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:367cbb6ee864c58b", "title": "https://medium.com/@1200km/how-to-create-a-vulnerable-windows-virtual-machine-for-pentesting-training-with-scripts-6dc39f0b3bb3", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/how-to-create-a-vulnerable-windows-virtual-machine-for-pentesting-training-with-scripts-6dc39f0b3bb3", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "How to Create a Vulnerable Windows Virtual Machine for Pentesting Training with scripts!", "url": "https://1200km.com/articles/read/2024/2024-11-20-how-to-create-a-vulnerable-windows-virtual-machine-for-pentesting-training-with-scripts-6dc39f0b3bb3/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:4312ca9815c9489c", "title": "https://medium.com/@1200km/information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:ee57f425846fb8e6", "title": "https://medium.com/@1200km/infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:0aac53cd99e90b6a", "title": "https://medium.com/@1200km/integrating-shodan-with-hexstrike-ai-using-gemini-cli-b6f9fcbe8e6e", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/integrating-shodan-with-hexstrike-ai-using-gemini-cli-b6f9fcbe8e6e", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Integrating Shodan with HexStrike-AI Using Gemini-CLI", "url": "https://1200km.com/articles/read/2025/2025-12-23-integrating-shodan-with-hexstrike-ai-using-gemini-cli-b6f9fcbe8e6e/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:38fad13270064480", "title": "https://medium.com/@1200km/john-the-ripper-hash-formats-f2ec958acaf8", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/john-the-ripper-hash-formats-f2ec958acaf8", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "John The Ripper Hash Formats", "url": "https://1200km.com/articles/read/2024/2024-11-15-john-the-ripper-hash-formats-f2ec958acaf8/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:9b8eaf31ceb4049b", "title": "https://medium.com/@1200km/kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:022eb4d89686563e", "title": "https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Lab Architecture — Operation DragonRx", "url": "https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:f08294d6dea8ba21", "title": "https://medium.com/@1200km/malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:ce19e234a81864f0", "title": "https://medium.com/@1200km/manual-cti-vs-ai-assisted-cti-a-step-by-step-clock-comparison-ee08325203fc", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/manual-cti-vs-ai-assisted-cti-a-step-by-step-clock-comparison-ee08325203fc", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "Manual CTI vs. AI-Assisted CTI: A Step-by-Step Clock Comparison", "url": "https://1200km.com/articles/read/2026/2026-05-08-manual-cti-vs-ai-assisted-cti-a-step-by-step-clock-comparison-ee08325203fc/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:4d9c08aece82a481", "title": "https://medium.com/@1200km/mastering-burp-suite-vulnerability-scanner-019ed82c8bac", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/mastering-burp-suite-vulnerability-scanner-019ed82c8bac", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Burp Suite Vulnerability Scanner", "url": "https://1200km.com/articles/read/2024/2024-11-11-mastering-burp-suite-vulnerability-scanner-019ed82c8bac/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:ea0a05ffaaaeb19b", "title": "https://medium.com/@1200km/mastering-dirbuster-a-strategic-approach-to-uncovering-hidden-web-assets-31c8406a892b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/mastering-dirbuster-a-strategic-approach-to-uncovering-hidden-web-assets-31c8406a892b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Mastering DirBuster: A Strategic Approach to Uncovering Hidden Web Assets", "url": "https://1200km.com/articles/read/2024/2024-11-10-mastering-dirbuster-a-strategic-approach-to-uncovering-hidden-web-assets-31c8406a892b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:816da94fe0500214", "title": "https://medium.com/@1200km/mastering-hydra-the-ultimate-guide-to-network-logon-cracking-182579dbaed1", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/mastering-hydra-the-ultimate-guide-to-network-logon-cracking-182579dbaed1", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Hydra: The Ultimate Guide to Network Logon Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-01-mastering-hydra-the-ultimate-guide-to-network-logon-cracking-182579dbaed1/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:af47a675bdfb7f8a", "title": "https://medium.com/@1200km/mastering-john-the-ripper-a-complete-guide-to-password-cracking-e42d68239c71", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/mastering-john-the-ripper-a-complete-guide-to-password-cracking-e42d68239c71", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering John the Ripper: A Complete Guide to Password Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-15-mastering-john-the-ripper-a-complete-guide-to-password-cracking-e42d68239c71/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:bca79d6514d9ff3d", "title": "https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1", "url": "https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:5e779b8eb000430f", "title": "https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 2", "url": "https://1200km.com/articles/read/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:6e272ba8d127ae06", "title": "https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 3", "url": "https://1200km.com/articles/read/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:8957d9413227dfac", "title": "https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 4. Scripts", "url": "https://1200km.com/articles/read/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:d44cdcb796277797", "title": "https://medium.com/@1200km/mastering-the-basics-essential-cli-tools-for-reconnaissance-in-penetration-testing-ee7fd9e36394", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/mastering-the-basics-essential-cli-tools-for-reconnaissance-in-penetration-testing-ee7fd9e36394", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering the Basics: Essential CLI Tools for Reconnaissance in Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-09-mastering-the-basics-essential-cli-tools-for-reconnaissance-in-penetration-testing-ee7fd9e36394/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:50ae216f9c5a6b52", "title": "https://medium.com/@1200km/meet-syscheck-beauty-a-colorful-linux-system-report-with-deep-storage-insights-and-exporta-a38329dfe085", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/meet-syscheck-beauty-a-colorful-linux-system-report-with-deep-storage-insights-and-exporta-a38329dfe085", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Meet syscheck_beauty: a colorful Linux system report with deep storage insights (and exportable…", "url": "https://1200km.com/articles/read/2025/2025-10-20-meet-syscheck-beauty-a-colorful-linux-system-report-with-deep-storage-insights-and-exporta-a38329dfe085/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:d36a1b4bf2482ed8", "title": "https://medium.com/@1200km/metasploit-modules-guide-auxiliary-1821db1712f0", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/metasploit-modules-guide-auxiliary-1821db1712f0", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Metasploit modules guide. Auxiliary", "url": "https://1200km.com/articles/read/2024/2024-11-18-metasploit-modules-guide-auxiliary-1821db1712f0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:57f39d3b88d23c8e", "title": "https://medium.com/@1200km/my-lab-82d780962213", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/my-lab-82d780962213", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "My lab:", "url": "https://1200km.com/articles/read/2026/2026-02-04-my-lab-82d780962213/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:0e892a8f17f213d6", "title": "https://medium.com/@1200km/navigate-my-blog-all-articles-by-topic-ffd800ef5480", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/navigate-my-blog-all-articles-by-topic-ffd800ef5480", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Navigate My Blog: All Articles by Topic", "url": "https://1200km.com/articles/read/2026/2026-03-16-navigate-my-blog-all-articles-by-topic-ffd800ef5480/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:aeff4ab5eb760003", "title": "https://medium.com/@1200km/nikto-uncovering-web-server-vulnerabilities-with-an-open-source-scanner-6d2d2fbc1e21", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/nikto-uncovering-web-server-vulnerabilities-with-an-open-source-scanner-6d2d2fbc1e21", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Nikto: Uncovering Web Server Vulnerabilities with an Open-Source Scanner", "url": "https://1200km.com/articles/read/2024/2024-11-12-nikto-uncovering-web-server-vulnerabilities-with-an-open-source-scanner-6d2d2fbc1e21/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:4f532e51c6fd8019", "title": "https://medium.com/@1200km/office-file-doc-docx-ppt-password-cracking-guide-with-real-life-examples-f8e356144ca4", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/office-file-doc-docx-ppt-password-cracking-guide-with-real-life-examples-f8e356144ca4", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Office file (DOC, DOCX, PPT…) Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-office-file-doc-docx-ppt-password-cracking-guide-with-real-life-examples-f8e356144ca4/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:aa2de780fc90f1fb", "title": "https://medium.com/@1200km/one-place-for-my-cybersecurity-projects-guides-articles-labs-tools-and-research-workflows-5d358753c86c", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/one-place-for-my-cybersecurity-projects-guides-articles-labs-tools-and-research-workflows-5d358753c86c", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "One place for my cybersecurity projects, guides, articles, labs, tools, and research workflows", "url": "https://1200km.com/articles/read/2026/2026-05-22-one-place-for-my-cybersecurity-projects-guides-articles-labs-tools-and-research-workflows-5d358753c86c/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:356a3718553030f9", "title": "https://medium.com/@1200km/one-prompt-ai-powered-black-box-kubernetes-penetration-test-c75a4747960e", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/one-prompt-ai-powered-black-box-kubernetes-penetration-test-c75a4747960e", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "One-Prompt AI-Powered Black-Box Kubernetes Penetration Test", "url": "https://1200km.com/articles/read/2026/2026-02-04-one-prompt-ai-powered-black-box-kubernetes-penetration-test-c75a4747960e/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:f6c082e6b2379524", "title": "https://medium.com/@1200km/one-tool-to-rule-them-all-file-metadata-and-static-analysis-for-malware-analysts-and-soc-t-c6dba1f5b7de", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/one-tool-to-rule-them-all-file-metadata-and-static-analysis-for-malware-analysts-and-soc-t-c6dba1f5b7de", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "One Tool to Rule Them All: File Metadata & Static Analysis for Malware Analysts and SOC Teams", "url": "https://1200km.com/articles/read/2026/2026-02-21-one-tool-to-rule-them-all-file-metadata-and-static-analysis-for-malware-analysts-and-soc-t-c6dba1f5b7de/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:554e205302b003ac", "title": "https://medium.com/@1200km/owasp-amass-project-guide-94bd55521f91", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/owasp-amass-project-guide-94bd55521f91", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "OWASP Amass Project guide", "url": "https://1200km.com/articles/read/2024/2024-11-06-owasp-amass-project-guide-94bd55521f91/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:66822c78b2125d4a", "title": "https://medium.com/@1200km/owasp-zap-a-comprehensive-guide-to-web-application-security-testing-6c247f4be39b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/owasp-zap-a-comprehensive-guide-to-web-application-security-testing-6c247f4be39b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "OWASP ZAP: A Comprehensive Guide to Web Application Security Testing", "url": "https://1200km.com/articles/read/2024/2024-11-12-owasp-zap-a-comprehensive-guide-to-web-application-security-testing-6c247f4be39b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:6ebd8a3f5841d336", "title": "https://medium.com/@1200km/passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:7175a2b866579bfe", "title": "https://medium.com/@1200km/pdf-file-password-cracking-guide-with-real-life-examples-901ee411a6f4", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/pdf-file-password-cracking-guide-with-real-life-examples-901ee411a6f4", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "PDF file Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-pdf-file-password-cracking-guide-with-real-life-examples-901ee411a6f4/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:3ede04ae36a1f9ec", "title": "https://medium.com/@1200km/pe-import-analyzer-a-practical-guide-for-malware-analysts-and-reverse-engineers-29b8b98aeaf3", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/pe-import-analyzer-a-practical-guide-for-malware-analysts-and-reverse-engineers-29b8b98aeaf3", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE Import Analyzer: A Practical Guide for Malware Analysts and Reverse Engineers", "url": "https://1200km.com/articles/read/2026/2026-02-26-pe-import-analyzer-a-practical-guide-for-malware-analysts-and-reverse-engineers-29b8b98aeaf3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:98ce951dd2d5fcb4", "title": "https://medium.com/@1200km/personal-pass-generator-ppg-the-ultimate-tool-for-custom-password-lists-4979a3a1385c", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/personal-pass-generator-ppg-the-ultimate-tool-for-custom-password-lists-4979a3a1385c", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Personal Pass Generator (PPG): The Ultimate Tool for Custom Password Lists", "url": "https://1200km.com/articles/read/2024/2024-10-20-personal-pass-generator-ppg-the-ultimate-tool-for-custom-password-lists-4979a3a1385c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:08fbdf4ea7ecf086", "title": "https://medium.com/@1200km/phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:2ab96151fa90c093", "title": "https://medium.com/@1200km/protocol-level-network-threat-hunting-a-wireshark-centric-guide-a6770ffc96c6", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/protocol-level-network-threat-hunting-a-wireshark-centric-guide-a6770ffc96c6", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "Protocol-Level Network Threat Hunting: A Wireshark-Centric Guide", "url": "https://1200km.com/articles/read/2025/2025-12-12-protocol-level-network-threat-hunting-a-wireshark-centric-guide-a6770ffc96c6/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:medium.com:5ab1d56ad1f7f835", "title": "https://medium.com/@1200km/quick-start-server-hardening-checklist-all-open-source-08e9887b9faa", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/quick-start-server-hardening-checklist-all-open-source-08e9887b9faa", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Quick‑Start Server Hardening Checklist (all open‑source)", "url": "https://1200km.com/articles/read/2025/2025-07-27-quick-start-server-hardening-checklist-all-open-source-08e9887b9faa/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:4d0629efff0fdcbb", "title": "https://medium.com/@1200km/reinventing-recon-nmap-meets-chatgpt-e2acb6130be5", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/reinventing-recon-nmap-meets-chatgpt-e2acb6130be5", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Reinventing Recon: Nmap Meets ChatGPT", "url": "https://1200km.com/articles/read/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:9b39d44abca0a586", "title": "https://medium.com/@1200km/sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Sending EKS Control Plane Logs via AWS Lambda", "url": "https://1200km.com/articles/read/2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:d85ea9ba3d90b983", "title": "https://medium.com/@1200km/shodan-guide-how-you-can-find-everything-640f47f41bbe", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/shodan-guide-how-you-can-find-everything-640f47f41bbe", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:268918551eb81a58", "title": "https://medium.com/@1200km/single-event-detection-rules-in-cybersecurity-aa7498f665bd", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/single-event-detection-rules-in-cybersecurity-aa7498f665bd", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:23b2e15f626a1b1e", "title": "https://medium.com/@1200km/soc-tier-1-the-complete-onboarding-guide-to-security-monitoring-and-incident-response-824a1dfe4476", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/soc-tier-1-the-complete-onboarding-guide-to-security-monitoring-and-incident-response-824a1dfe4476", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "SOC Tier 1: The Complete Onboarding Guide to Security Monitoring and Incident Response", "url": "https://1200km.com/articles/read/2025/2025-02-24-soc-tier-1-the-complete-onboarding-guide-to-security-monitoring-and-incident-response-824a1dfe4476/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:31af971651022323", "title": "https://medium.com/@1200km/spiderfoot-deep-dive-installation-scans-and-practical-use-cases-11ea6537ad6f", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/spiderfoot-deep-dive-installation-scans-and-practical-use-cases-11ea6537ad6f", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "SpiderFoot Deep Dive: Installation, Scans, and Practical Use Cases", "url": "https://1200km.com/articles/read/2025/2025-11-23-spiderfoot-deep-dive-installation-scans-and-practical-use-cases-11ea6537ad6f/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:e0ae2930a0ab55c8", "title": "https://medium.com/@1200km/spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "SPW AW25 — PO.010 SMS.exe.exe (AgentTesla)", "url": "https://1200km.com/articles/read/2025/2025-03-24-spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:50e48253ff7f3a91", "title": "https://medium.com/@1200km/sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 1. (basic, wizard)", "url": "https://1200km.com/articles/read/2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:33f216b284255867", "title": "https://medium.com/@1200km/sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 2. (Advanced, custom setup)", "url": "https://1200km.com/articles/read/2024/2024-11-05-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:f508ad01a946ae54", "title": "https://medium.com/@1200km/static-malware-analysis-file-fingerprinting-3ddf9bdd7864", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/static-malware-analysis-file-fingerprinting-3ddf9bdd7864", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Static Malware Analysis. File Fingerprinting", "url": "https://1200km.com/articles/read/2025/2025-04-01-static-malware-analysis-file-fingerprinting-3ddf9bdd7864/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:f1063bff8e0143ce", "title": "https://medium.com/@1200km/static-malware-analysis-obfuscation-51de3992065d", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/static-malware-analysis-obfuscation-51de3992065d", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Static Malware Analysis . Obfuscation.", "url": "https://1200km.com/articles/read/2025/2025-03-30-static-malware-analysis-obfuscation-51de3992065d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:79f768f1bd5cfe96", "title": "https://medium.com/@1200km/static-malware-analysis-strings-analysis-e876640cfdb0", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/static-malware-analysis-strings-analysis-e876640cfdb0", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Static Malware Analysis. Strings analysis.", "url": "https://1200km.com/articles/read/2025/2025-03-29-static-malware-analysis-strings-analysis-e876640cfdb0/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:8435aff3d4b8f79b", "title": "https://medium.com/@1200km/stratusai-i-built-an-ai-powered-cloud-security-scanner-for-aws-and-gcp-here-s-everything-89c6702d3b84", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/stratusai-i-built-an-ai-powered-cloud-security-scanner-for-aws-and-gcp-here-s-everything-89c6702d3b84", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "StratusAI: I Built an AI-Powered Cloud Security Scanner for AWS and GCP — Here’s Everything", "url": "https://1200km.com/articles/read/2026/2026-03-14-stratusai-i-built-an-ai-powered-cloud-security-scanner-for-aws-and-gcp-here-s-everything-89c6702d3b84/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:medium.com:5937deff10a14952", "title": "https://medium.com/@1200km/sublist3r-your-essential-tool-for-subdomain-enumeration-c1910121d712", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/sublist3r-your-essential-tool-for-subdomain-enumeration-c1910121d712", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Sublist3r. Your Essential Tool for Subdomain Enumeration", "url": "https://1200km.com/articles/read/2024/2024-11-07-sublist3r-your-essential-tool-for-subdomain-enumeration-c1910121d712/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:700eaf3d56b7ff7f", "title": "https://medium.com/@1200km/the-20x-employee-a-strategic-framework-for-unlocking-hyper-productivity-with-artificial-8f49cde95a25", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-20x-employee-a-strategic-framework-for-unlocking-hyper-productivity-with-artificial-8f49cde95a25", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "The 20x Employee: A Strategic Framework for Unlocking Hyper-Productivity with Artificial…", "url": "https://1200km.com/articles/read/2025/2025-08-01-the-20x-employee-a-strategic-framework-for-unlocking-hyper-productivity-with-artificial-8f49cde95a25/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:ac6a285662780b93", "title": "https://medium.com/@1200km/the-ai-revolution-in-offensive-security-31e44704d51a", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-ai-revolution-in-offensive-security-31e44704d51a", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" } ], "used_in": [ { "title": "The AI Revolution in Offensive Security", "url": "https://1200km.com/articles/read/2026/2026-01-19-the-ai-revolution-in-offensive-security-31e44704d51a/", "type": "article", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:medium.com:89f1cd691a1ca672", "title": "https://medium.com/@1200km/the-atomic-standard-a-practitioner-s-compendium-for-single-event-threat-detection-570c4241d4d9", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-atomic-standard-a-practitioner-s-compendium-for-single-event-threat-detection-570c4241d4d9", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "The Atomic Standard: A Practitioner’s Compendium for Single-Event Threat Detection", "url": "https://1200km.com/articles/read/2025/2025-11-01-the-atomic-standard-a-practitioner-s-compendium-for-single-event-threat-detection-570c4241d4d9/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:704bcf9330fd012b", "title": "https://medium.com/@1200km/the-atomic-standard-a-practitioners-compendium-for-single-event-threat-detection-570c4241d4d9", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-atomic-standard-a-practitioners-compendium-for-single-event-threat-detection-570c4241d4d9", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:53de604bcfefede9", "title": "https://medium.com/@1200km/the-basic-toolkit-for-penetration-testing-303da9234d82", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-basic-toolkit-for-penetration-testing-303da9234d82", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:dd2b260a25053ce9", "title": "https://medium.com/@1200km/the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Complete Guide to AI-Driven Penetration Testing: Cursor, MCP, and the Modern PT Workflow", "url": "https://1200km.com/articles/read/2026/2026-02-19-the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:babba4176a0ecbc8", "title": "https://medium.com/@1200km/the-invisible-pipeline-defending-ci-cd-from-targeted-attacks-456283ee5ed3", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-invisible-pipeline-defending-ci-cd-from-targeted-attacks-456283ee5ed3", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "The Invisible Pipeline: Defending CI/CD from Targeted Attacks", "url": "https://1200km.com/articles/read/2025/2025-10-14-the-invisible-pipeline-defending-ci-cd-from-targeted-attacks-456283ee5ed3/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:076ceb8842a80330", "title": "https://medium.com/@1200km/the-one-prompt-pt-lab-autonomous-android-security-research-with-cursor-ai-b96ed2053071", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-one-prompt-pt-lab-autonomous-android-security-research-with-cursor-ai-b96ed2053071", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The One-Prompt PT Lab: Autonomous Android Security Research with Cursor AI", "url": "https://1200km.com/articles/read/2026/2026-01-17-the-one-prompt-pt-lab-autonomous-android-security-research-with-cursor-ai-b96ed2053071/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:d23397b706434ea3", "title": "https://medium.com/@1200km/the-ultimate-guide-to-metasploit-part-1-43c8573487df", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-ultimate-guide-to-metasploit-part-1-43c8573487df", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Ultimate Guide to Metasploit. Part 1.", "url": "https://1200km.com/articles/read/2024/2024-11-17-the-ultimate-guide-to-metasploit-part-1-43c8573487df/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:0f2f7eb45bc4ddd7", "title": "https://medium.com/@1200km/theharvester-your-essential-tool-for-osint-and-reconnaissance-in-cybersecurity-10aa6d76f5b3", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/theharvester-your-essential-tool-for-osint-and-reconnaissance-in-cybersecurity-10aa6d76f5b3", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" } ], "used_in": [ { "title": "theHarvester: Your Essential Tool for OSINT and Reconnaissance in Cybersecurity", "url": "https://1200km.com/articles/read/2024/2024-11-07-theharvester-your-essential-tool-for-osint-and-reconnaissance-in-cybersecurity-10aa6d76f5b3/", "type": "article", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:medium.com:fa181b956d9cff0a", "title": "https://medium.com/@1200km/threat-hunting-with-the-pyramid-of-pain-8add3cedb380", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/threat-hunting-with-the-pyramid-of-pain-8add3cedb380", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "Threat Hunting with the Pyramid of Pain", "url": "https://1200km.com/articles/read/2025/2025-07-09-threat-hunting-with-the-pyramid-of-pain-8add3cedb380/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:medium.com:a35175a0ecb902a2", "title": "https://medium.com/@1200km/title-metasploit-modules-guide-exploit-73eecb50e3c3", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/title-metasploit-modules-guide-exploit-73eecb50e3c3", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Title Metasploit modules guide. Exploit", "url": "https://1200km.com/articles/read/2024/2024-11-24-title-metasploit-modules-guide-exploit-73eecb50e3c3/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:54f0e06e7f254ddb", "title": "https://medium.com/@1200km/tools-by-mitre-att-and-ck-guide-77c4d947ba36", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/tools-by-mitre-att-and-ck-guide-77c4d947ba36", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Tools by MITRE ATT&CK Guide", "url": "https://1200km.com/articles/read/2025/2025-06-17-tools-by-mitre-att-and-ck-guide-77c4d947ba36/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:385d52005435dfd5", "title": "https://medium.com/@1200km/unlocking-web-intelligence-a-deep-dive-into-whatweb-8ee4e64ce411", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/unlocking-web-intelligence-a-deep-dive-into-whatweb-8ee4e64ce411", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Unlocking Web Intelligence: A Deep Dive into WhatWeb", "url": "https://1200km.com/articles/read/2024/2024-11-10-unlocking-web-intelligence-a-deep-dive-into-whatweb-8ee4e64ce411/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:aebcc24f51f45c4e", "title": "https://medium.com/@1200km/unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Unpacker: A Practical Guide to Modular Malware Packer Detection and Unpacking", "url": "https://1200km.com/articles/read/2026/2026-02-28-unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:f84d87bc9329f90f", "title": "https://medium.com/@1200km/villager-the-ai-powered-penetration-testing-framework-8df10532e265", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/villager-the-ai-powered-penetration-testing-framework-8df10532e265", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Villager: The AI-Powered Penetration Testing Framework", "url": "https://1200km.com/articles/read/2025/2025-10-13-villager-the-ai-powered-penetration-testing-framework-8df10532e265/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:db55125186d6730f", "title": "https://medium.com/@1200km/vulnerable-ai-lab-3747e96314dd", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/vulnerable-ai-lab-3747e96314dd", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "Vulnerable AI Lab", "url": "https://1200km.com/articles/read/2026/2026-04-28-vulnerable-ai-lab-3747e96314dd/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:86c2ab6158e02d21", "title": "https://medium.com/@1200km/warning-i-just-built-real-malware-by-using-just-human-language-prompts-8949628dee19", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/warning-i-just-built-real-malware-by-using-just-human-language-prompts-8949628dee19", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "⚠️ WARNING: I Just Built Real Malware by using just human language prompts!", "url": "https://1200km.com/articles/read/2026/2026-02-05-warning-i-just-built-real-malware-by-using-just-human-language-prompts-8949628dee19/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:2911029decd28a69", "title": "https://medium.com/@1200km/web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Web Applications Penetretion Testing. Stage 1: Reconnaissance", "url": "https://1200km.com/articles/read/2024/2024-11-10-web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:a5a82ef324e8d826", "title": "https://medium.com/@1200km/web-applications-penetretion-testing-stage-2-scanning-and-vulnerability-assessment-15021e81c130", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/web-applications-penetretion-testing-stage-2-scanning-and-vulnerability-assessment-15021e81c130", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Web Applications Penetretion Testing. Stage 2: Scanning and Vulnerability Assessment", "url": "https://1200km.com/articles/read/2024/2024-11-13-web-applications-penetretion-testing-stage-2-scanning-and-vulnerability-assessment-15021e81c130/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:578514aa624af9c0", "title": "https://medium.com/@1200km/welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:8b52a9c3c2ef0d67", "title": "https://medium.com/@1200km/what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:08f6705d9a35e625", "title": "https://medium.com/@1200km/what-is-malware-93746950ce9a", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/what-is-malware-93746950ce9a", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "What Is Malware?", "url": "https://1200km.com/articles/read/2026/2026-08-06-what-is-malware-93746950ce9a/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:843916e700b79fb8", "title": "https://medium.com/@1200km/when-ai-coding-agents-say-yes-too-easily-testing-suspicious-cybersecurity-prompts-in-cursor-55eea06b69bd", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/when-ai-coding-agents-say-yes-too-easily-testing-suspicious-cybersecurity-prompts-in-cursor-55eea06b69bd", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "When AI Coding Agents Say Yes Too Easily: Testing Suspicious Cybersecurity Prompts in Cursor", "url": "https://1200km.com/articles/read/2026/2026-07-07-when-ai-coding-agents-say-yes-too-easily-testing-suspicious-cybersecurity-prompts-in-curso-55eea06b69bd/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:53b706252c0122d4", "title": "https://medium.com/@1200km/wifi-cracking-with-aircrack-ng-d51cf98c789f", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/wifi-cracking-with-aircrack-ng-d51cf98c789f", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "WiFi cracking with Aircrack-ng", "url": "https://1200km.com/articles/read/2024/2024-10-17-wifi-cracking-with-aircrack-ng-d51cf98c789f/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:1dfc9deed91b8209", "title": "https://medium.com/@1200km/zip-file-password-cracking-guide-with-real-life-examples-4e8705d51897", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/zip-file-password-cracking-guide-with-real-life-examples-4e8705d51897", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "ZIP file Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-zip-file-password-cracking-guide-with-real-life-examples-4e8705d51897/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:modelcontextprotocol.io:0613e0768dfbe408", "title": "https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices", "publisher": "Modelcontextprotocol", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "modelcontextprotocol.io", "key": "publisher-domain:modelcontextprotocol.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:msrc.microsoft.com:76662c24242428ec", "title": "https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard", "description": "External source cited by 1 maintained 1200km page.", "url": "https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard", "publisher": "MSRC Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "msrc.microsoft.com", "key": "publisher-domain:msrc.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:mxtoolbox.com:f65879518abc302d", "title": "https://mxtoolbox.com/SuperTool.aspx", "description": "External source cited by 1 maintained 1200km page.", "url": "https://mxtoolbox.com/SuperTool.aspx", "publisher": "Mxtoolbox", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mxtoolbox.com", "key": "publisher-domain:mxtoolbox.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:nvd.nist.gov:f463a848236c8492", "title": "https://nvd.nist.gov/developers/vulnerabilities", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/developers/vulnerabilities", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:nvd.nist.gov:e32208b52f9d6e9b", "title": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:op-c.net:27048901458feefb", "title": "https://op-c.net/blog/did-op-innovate-disrupt-handala-cyber-threat", "description": "External source cited by 1 maintained 1200km page.", "url": "https://op-c.net/blog/did-op-innovate-disrupt-handala-cyber-threat", "publisher": "OP C", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "op-c.net", "key": "publisher-domain:op-c.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:op-c.net:91d391e484198190", "title": "https://op-c.net/blog/unpacking-handala", "description": "External source cited by 1 maintained 1200km page.", "url": "https://op-c.net/blog/unpacking-handala", "publisher": "OP C", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "op-c.net", "key": "publisher-domain:op-c.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:opentelemetry.io:52aca0cf0c88da86", "title": "https://opentelemetry.io/docs/specs/semconv", "description": "External source cited by 1 maintained 1200km page.", "url": "https://opentelemetry.io/docs/specs/semconv", "publisher": "Opentelemetry", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "opentelemetry.io", "key": "publisher-domain:opentelemetry.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:opentelemetry.io:9822659f00ff310f", "title": "https://opentelemetry.io/docs/specs/semconv/registry/attributes/gen-ai", "description": "External source cited by 1 maintained 1200km page.", "url": "https://opentelemetry.io/docs/specs/semconv/registry/attributes/gen-ai", "publisher": "Opentelemetry", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "opentelemetry.io", "key": "publisher-domain:opentelemetry.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:pentestmonkey.net:fd4bf5a4d21410e4", "title": "https://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats", "description": "External source cited by 1 maintained 1200km page.", "url": "https://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats", "publisher": "Pentestmonkey", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "pentestmonkey.net", "key": "publisher-domain:pentestmonkey.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "John The Ripper Hash Formats", "url": "https://1200km.com/articles/read/2024/2024-11-15-john-the-ripper-hash-formats-f2ec958acaf8/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:platform.openai.com:c7775785cd645c70", "title": "https://platform.openai.com/docs/guides/evaluation-best-practices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://platform.openai.com/docs/guides/evaluation-best-practices", "publisher": "Platform Openai", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "platform.openai.com", "key": "publisher-domain:platform.openai.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:registry.terraform.io:7b5ab9aa14ab5913", "title": "https://registry.terraform.io/providers/hashicorp/google/latest/docs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://registry.terraform.io/providers/hashicorp/google/latest/docs", "publisher": "Registry Terraform", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "registry.terraform.io", "key": "publisher-domain:registry.terraform.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:research.checkpoint.com:1397d6e758856e4c", "title": "https://research.checkpoint.com/2025/3rd-february-threat-intelligence-report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://research.checkpoint.com/2025/3rd-february-threat-intelligence-report", "publisher": "Research Checkpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:research.checkpoint.com:8e3102eb8215c638", "title": "https://research.checkpoint.com/2025/6th-january-threat-intelligence-report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://research.checkpoint.com/2025/6th-january-threat-intelligence-report", "publisher": "Research Checkpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:research.checkpoint.com:5d16c4ffe4ad3be9", "title": "https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi", "description": "External source cited by 1 maintained 1200km page.", "url": "https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi", "publisher": "Research Checkpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:resources.sei.cmu.edu:11012f24b01e2be0", "title": "https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=552459", "description": "External source cited by 1 maintained 1200km page.", "url": "https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=552459", "publisher": "Resources SEI CMU", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "resources.sei.cmu.edu", "key": "publisher-domain:resources.sei.cmu.edu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:search.censys.io:3aeecda779521b59", "title": "https://search.censys.io/search/language", "description": "External source cited by 1 maintained 1200km page.", "url": "https://search.censys.io/search/language", "publisher": "Search Censys", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "search.censys.io", "key": "publisher-domain:search.censys.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:securelist.com:892aec30f9356189", "title": "https://securelist.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://securelist.com", "publisher": "Securelist", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "securelist.com", "key": "publisher-domain:securelist.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:securitytrails.com:f6633fc5a12a7a3b", "title": "https://securitytrails.com/list/ns/elliott.ns.cloudflare.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://securitytrails.com/list/ns/elliott.ns.cloudflare.com", "publisher": "Securitytrails", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "securitytrails.com", "key": "publisher-domain:securitytrails.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:sigmahq.io:c0a4d5e259f49f3b", "title": "https://sigmahq.io/sigma", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sigmahq.io/sigma", "publisher": "Sigmahq", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sigmahq.io", "key": "publisher-domain:sigmahq.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:sigmahq.io:0976ee2ea50c2265", "title": "https://sigmahq.io/sigma-specification/specification/sigma-rules-specification.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sigmahq.io/sigma-specification/specification/sigma-rules-specification.html", "publisher": "Sigmahq", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sigmahq.io", "key": "publisher-domain:sigmahq.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:socradar.io:19d1f9a3abe7fadb", "title": "https://socradar.io/blog/dark-web-profile-storm-842-void-manticore", "description": "External source cited by 1 maintained 1200km page.", "url": "https://socradar.io/blog/dark-web-profile-storm-842-void-manticore", "publisher": "Socradar", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "socradar.io", "key": "publisher-domain:socradar.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:spyonweb.com:7e239a875432d7f9", "title": "https://spyonweb.com/ns1.custom-nameserver.example", "description": "External source cited by 1 maintained 1200km page.", "url": "https://spyonweb.com/ns1.custom-nameserver.example", "publisher": "Spyonweb", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "spyonweb.com", "key": "publisher-domain:spyonweb.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:support.citrix.com:b8f1173f3c00ace6", "title": "https://support.citrix.com/article/CTX579459", "description": "External source cited by 1 maintained 1200km page.", "url": "https://support.citrix.com/article/CTX579459", "publisher": "Support Citrix", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "support.citrix.com", "key": "publisher-domain:support.citrix.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:tetragon.io:6055992179721743", "title": "https://tetragon.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://tetragon.io", "publisher": "Tetragon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "tetragon.io", "key": "publisher-domain:tetragon.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:therecord.media:964f8581e64ccef6", "title": "https://therecord.media/hackers-hijack-sirens-iran-israel", "description": "External source cited by 1 maintained 1200km page.", "url": "https://therecord.media/hackers-hijack-sirens-iran-israel", "publisher": "Therecord", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "therecord.media", "key": "publisher-domain:therecord.media" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:ubuntu.com:0cd23ca7b3753b5d", "title": "https://ubuntu.com/download/server%3E?referrer=grok.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ubuntu.com/download/server%3E?referrer=grok.com", "publisher": "Ubuntu", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ubuntu.com", "key": "publisher-domain:ubuntu.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Building an Extremely Vulnerable Ubuntu 24.04 Server Lab (Bonus: Full PT with Hexstrike)", "url": "https://1200km.com/articles/read/2026/2026-01-06-building-an-extremely-vulnerable-ubuntu-24-04-server-lab-bonus-full-pt-with-hexstrike-90034032775b/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:46a9bb3e0fb15336", "title": "https://unit42.paloaltonetworks.com/handala-hack-wiper-attacks", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/handala-hack-wiper-attacks", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:2c2cc149a75ab028", "title": "https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:vaniloin.fun:bb3a0757f7680e3f", "title": "https://vaniloin.fun/<endpoint", "description": "External source cited by 1 maintained 1200km page.", "url": "https://vaniloin.fun/<endpoint", "publisher": "Vaniloin", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "vaniloin.fun", "key": "publisher-domain:vaniloin.fun" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:viewdns.info:9ee388e8a68c22ca", "title": "https://viewdns.info/reversens/?ns=hera.ns.cloudflare.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://viewdns.info/reversens/?ns=hera.ns.cloudflare.com", "publisher": "Viewdns", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "viewdns.info", "key": "publisher-domain:viewdns.info" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:virustotal.com:90e79ec392c33e14", "title": "https://virustotal.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://virustotal.com", "publisher": "Virustotal", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "virustotal.com", "key": "publisher-domain:virustotal.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:weakpass.com:a6bf9ef2f05c99ae", "title": "https://weakpass.com/wordlists", "description": "External source cited by 1 maintained 1200km page.", "url": "https://weakpass.com/wordlists", "publisher": "Weakpass", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "weakpass.com", "key": "publisher-domain:weakpass.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Complete Guide to AI-Driven Penetration Testing: Cursor, MCP, and the Modern PT Workflow", "url": "https://1200km.com/articles/read/2026/2026-02-19-the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:web-assets.eset.com:ecd1e19687a165d9", "title": "https://web-assets.eset.com/fileadmin/ESET/IT_2/eset-apt-activity-report-q2-2025-q3-2025.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://web-assets.eset.com/fileadmin/ESET/IT_2/eset-apt-activity-report-q2-2025-q3-2025.pdf", "publisher": "WEB Assets ESET", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "web-assets.eset.com", "key": "publisher-domain:web-assets.eset.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:atomicredteam.io:28227878515347d7", "title": "https://www.atomicredteam.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.atomicredteam.io", "publisher": "Atomicredteam", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "atomicredteam.io", "key": "publisher-domain:atomicredteam.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:bleepingcomputer.com:1e4b47515ae25e7d", "title": "https://www.bleepingcomputer.com/news/security/fake-crowdstrike-fixes-target-companies-with-malware-data-wipers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.bleepingcomputer.com/news/security/fake-crowdstrike-fixes-target-companies-with-malware-data-wipers", "publisher": "Bleepingcomputer", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "bleepingcomputer.com", "key": "publisher-domain:bleepingcomputer.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cedarpolicy.com:1e189066d3aa8543", "title": "https://www.cedarpolicy.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cedarpolicy.com", "publisher": "Cedarpolicy", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cedarpolicy.com", "key": "publisher-domain:cedarpolicy.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cia.gov:4a672b6385b05681", "title": "https://www.cia.gov/resources/csi/books-monographs/a-tradecraft-primer", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cia.gov/resources/csi/books-monographs/a-tradecraft-primer", "publisher": "CIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cia.gov", "key": "publisher-domain:cia.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cia.gov:747d3061eceb6e14", "title": "https://www.cia.gov/resources/csi/books-monographs/psychology-of-intelligence-analysis-2", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cia.gov/resources/csi/books-monographs/psychology-of-intelligence-analysis-2", "publisher": "CIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cia.gov", "key": "publisher-domain:cia.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cia.gov:520a44249130d9ec", "title": "https://www.cia.gov/resources/csi/static/Words-of-Estimative-Probability.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cia.gov/resources/csi/static/Words-of-Estimative-Probability.pdf", "publisher": "CIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cia.gov", "key": "publisher-domain:cia.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cia.gov:97582afd232734ad", "title": "https://www.cia.gov/resources/csi/studies-in-intelligence/studies-in-intelligence-articles/words-of-estimative-probability", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cia.gov/resources/csi/studies-in-intelligence/studies-in-intelligence-articles/words-of-estimative-probability", "publisher": "CIA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cia.gov", "key": "publisher-domain:cia.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cisa.gov:7c432c30f574919f", "title": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-356a", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-356a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" }, { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:cisa.gov:efa24469000bbf9a", "title": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cisa.gov:a8989a2539f60bba", "title": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cisa.gov:b05adbf5d84e7fa7", "title": "https://www.cisa.gov/resources-tools/resources/insider-threat-mitigation-guide", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/resources-tools/resources/insider-threat-mitigation-guide", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cisa.gov:66d1f756630e44f4", "title": "https://www.cisa.gov/sites/default/files/2023-04/aa23-108a_joint_csa_dprk_cryptocurrency_theft_0.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/sites/default/files/2023-04/aa23-108a_joint_csa_dprk_cryptocurrency_theft_0.pdf", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cisa.gov:d051a0326d4c14fe", "title": "https://www.cisa.gov/sites/default/files/publications/AA22-054A%20New%20Sandworm%20Malware%20Cyclops%20Blink%20Replaces%20VPN%20Filter.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/sites/default/files/publications/AA22-054A%20New%20Sandworm%20Malware%20Cyclops%20Blink%20Replaces%20VPN%20Filter.pdf", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cisa.gov:62796f6a141eecea", "title": "https://www.cisa.gov/ssvc", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/ssvc", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:clearskysec.com:46218a735b32d6f2", "title": "https://www.clearskysec.com/operation-dream-job", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.clearskysec.com/operation-dream-job", "publisher": "Clearskysec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "clearskysec.com", "key": "publisher-domain:clearskysec.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:computerweekly.com:00d8157129dc2c27", "title": "https://www.computerweekly.com/news/366619473/Warning-over-privacy-of-encrypted-messages-as-Russia-targets-Signal-Messenger", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.computerweekly.com/news/366619473/Warning-over-privacy-of-encrypted-messages-as-Russia-targets-Signal-Messenger", "publisher": "Computerweekly", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "computerweekly.com", "key": "publisher-domain:computerweekly.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:crowdstrike.com:ddac3a749352d782", "title": "https://www.crowdstrike.com/en-us/adversaries/banished-kitten", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.crowdstrike.com/en-us/adversaries/banished-kitten", "publisher": "Crowdstrike", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "crowdstrike.com", "key": "publisher-domain:crowdstrike.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cyberark.com:42d7bb8738e1925f", "title": "https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-services", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-services", "publisher": "Cyberark", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cyberark.com", "key": "publisher-domain:cyberark.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:dni.gov:d9ce5ea2b1404de2", "title": "https://www.dni.gov/index.php/newsroom/press-releases/press-releases-2024/3981-joint-odni-fbi-and-cisa-statement-on-iranian-election-influence-efforts", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.dni.gov/index.php/newsroom/press-releases/press-releases-2024/3981-joint-odni-fbi-and-cisa-statement-on-iranian-election-influence-efforts", "publisher": "DNI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dni.gov", "key": "publisher-domain:dni.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:domaintools.com:da807951f772b03b", "title": "https://www.domaintools.com/products/iris", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.domaintools.com/products/iris", "publisher": "Domaintools", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "domaintools.com", "key": "publisher-domain:domaintools.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:dtexsystems.com:50b118daafcc0cb5", "title": "https://www.dtexsystems.com/resource/2023-insider-risk-report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.dtexsystems.com/resource/2023-insider-risk-report", "publisher": "Dtexsystems", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dtexsystems.com", "key": "publisher-domain:dtexsystems.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:elastic.co:80389bb9c7619872", "title": "https://www.elastic.co/docs/explore-analyze/query-filter/languages/eql", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.elastic.co/docs/explore-analyze/query-filter/languages/eql", "publisher": "Elastic", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "elastic.co", "key": "publisher-domain:elastic.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:elastic.co:391b82bebc88c120", "title": "https://www.elastic.co/docs/solutions/security/detect-and-alert/eql", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/eql", "publisher": "Elastic", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "elastic.co", "key": "publisher-domain:elastic.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:elastic.co:855098c7d70b3a5e", "title": "https://www.elastic.co/docs/solutions/security/detect-and-alert/validate-and-test-rules", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/validate-and-test-rules", "publisher": "Elastic", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "elastic.co", "key": "publisher-domain:elastic.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:elastic.co:d01cc29fccb97c64", "title": "https://www.elastic.co/guide/en/ecs/current/ecs-reference.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.elastic.co/guide/en/ecs/current/ecs-reference.html", "publisher": "Elastic", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "elastic.co", "key": "publisher-domain:elastic.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:erlang.org:1725d448aa428ab3", "title": "https://www.erlang.org/security", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.erlang.org/security", "publisher": "Erlang", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "erlang.org", "key": "publisher-domain:erlang.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:esecurityplanet.com:0336f05fe0b7a482", "title": "https://www.esecurityplanet.com/threats/handala-leak-shows-telegram-account-risk-not-iphone-hacks", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.esecurityplanet.com/threats/handala-leak-shows-telegram-account-risk-not-iphone-hacks", "publisher": "Esecurityplanet", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "esecurityplanet.com", "key": "publisher-domain:esecurityplanet.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:eset.com:d3ad42ba8da933f7", "title": "https://www.eset.com/int/about/newsroom/research", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.eset.com/int/about/newsroom/research", "publisher": "ESET", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eset.com", "key": "publisher-domain:eset.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:eset.com:9b30e7f1a145edb9", "title": "https://www.eset.com/us/about/newsroom/research/eset-research-apt-report-russian-cyberattacks-in-ukraine-intensify-sandworm-unleashes-new-destructive-wiper", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.eset.com/us/about/newsroom/research/eset-research-apt-report-russian-cyberattacks-in-ukraine-intensify-sandworm-unleashes-new-destructive-wiper", "publisher": "ESET", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eset.com", "key": "publisher-domain:eset.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:europol.europa.eu:a705384d2d3558b3", "title": "https://www.europol.europa.eu/media-press/newsroom/news/8-arrested-in-spain", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.europol.europa.eu/media-press/newsroom/news/8-arrested-in-spain", "publisher": "Europol Europa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "europol.europa.eu", "key": "publisher-domain:europol.europa.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:first.org:8d9ba811620bcda8", "title": "https://www.first.org/cvss", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.first.org/cvss", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:first.org:71bb78c8a5ef067e", "title": "https://www.first.org/education/trainings", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.first.org/education/trainings", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:first.org:af106d89e97e8f6e", "title": "https://www.first.org/global/sigs/cti/curriculum/source-evaluation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.first.org/global/sigs/cti/curriculum/source-evaluation", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:fortiguard.com:7e397c365806fbc4", "title": "https://www.fortiguard.com/psirt/FG-IR-24-015", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.fortiguard.com/psirt/FG-IR-24-015", "publisher": "Fortiguard", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fortiguard.com", "key": "publisher-domain:fortiguard.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:gov.uk:086fb9f23864b63f", "title": "https://www.gov.uk/government/news/uk-condemns-russias-gru-over-georgia-cyber-attacks", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.uk/government/news/uk-condemns-russias-gru-over-georgia-cyber-attacks", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.uk", "key": "publisher-domain:gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:gov.uk:07e3aa9c66378ef6", "title": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.uk", "key": "publisher-domain:gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:gov.uk:41d8a71f19e2d7d9", "title": "https://www.gov.uk/government/publications/profile-gru-cyber-and-hybrid-threat-operations/profile-gru-cyber-and-hybrid-threat-operations", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.uk/government/publications/profile-gru-cyber-and-hybrid-threat-operations/profile-gru-cyber-and-hybrid-threat-operations", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.uk", "key": "publisher-domain:gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:group-ib.com:ee1f8feabf2982e4", "title": "https://www.group-ib.com/resources/research", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.group-ib.com/resources/research", "publisher": "Group IB", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "group-ib.com", "key": "publisher-domain:group-ib.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:hybrid-analysis.com:921680a89bf52b8c", "title": "https://www.hybrid-analysis.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.hybrid-analysis.com", "publisher": "Hybrid Analysis", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "hybrid-analysis.com", "key": "publisher-domain:hybrid-analysis.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:international.gc.ca:1b21ff436ae1db42", "title": "https://www.international.gc.ca/transparency-transparence/rapid-response-mechanism-mecanisme-reponse-rapide/iran-hack-piratage-iranien.aspx?lang=eng", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.international.gc.ca/transparency-transparence/rapid-response-mechanism-mecanisme-reponse-rapide/iran-hack-piratage-iranien.aspx?lang=eng", "publisher": "International GC", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "international.gc.ca", "key": "publisher-domain:international.gc.ca" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:iranintl.com:00e2dfcb6664843d", "title": "https://www.iranintl.com/202507086458", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.iranintl.com/202507086458", "publisher": "Iranintl", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "iranintl.com", "key": "publisher-domain:iranintl.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:israelhayom.com:e6a9d9339482ce9f", "title": "https://www.israelhayom.com/2025/12/28/handala-hackers-iranian-cyber-attacks-israel-officials", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.israelhayom.com/2025/12/28/handala-hackers-iranian-cyber-attacks-israel-officials", "publisher": "Israelhayom", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "israelhayom.com", "key": "publisher-domain:israelhayom.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:jns.org:03f761ab0f4f5fb3", "title": "https://www.jns.org/iranians-claim-they-hacked-former-israeli-pm-bennetts-phone", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.jns.org/iranians-claim-they-hacked-former-israeli-pm-bennetts-phone", "publisher": "JNS", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "jns.org", "key": "publisher-domain:jns.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:joesandbox.com:6b26b1ea99f544f4", "title": "https://www.joesandbox.com", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.joesandbox.com", "publisher": "Joesandbox", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "joesandbox.com", "key": "publisher-domain:joesandbox.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AdversaryGraph vs Malware Sandboxes", "url": "https://1200km.com/adversarygraph-docs/comparisons/malware-sandboxes/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:jpost.com:95df979a81f5f8c7", "title": "https://www.jpost.com/israel-news/article-887911", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.jpost.com/israel-news/article-887911", "publisher": "Jpost", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "jpost.com", "key": "publisher-domain:jpost.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:justice.gov:b063e8b3aba3921f", "title": "https://www.justice.gov/archive/usao/nj/Press/files/pdffiles/Duroniosen.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/archive/usao/nj/Press/files/pdffiles/Duroniosen.pdf", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:3b2aa748a726e23a", "title": "https://www.justice.gov/opa/pr/ge-engineer-and-chinese-businessman-charged-economic-espionage-and-theft-trade-secrets", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/opa/pr/ge-engineer-and-chinese-businessman-charged-economic-espionage-and-theft-trade-secrets", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:e728ef654d300bbf", "title": "https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:justice.gov:326f77643716f341", "title": "https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-associates-charged-connection-computer", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-associates-charged-connection-computer", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:justice.gov:d62dd54717e9c5da", "title": "https://www.justice.gov/opa/speech/remarks-assistant-attorney-general-national-security-john-c-demers-announcement-charges", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.justice.gov/opa/speech/remarks-assistant-attorney-general-national-security-john-c-demers-announcement-charges", "publisher": "Justice", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "justice.gov", "key": "publisher-domain:justice.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:kali.org:8bc1e0363262eaa6", "title": "https://www.kali.org/docs/virtualization/install-vmware-host/?referrer=grok.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.kali.org/docs/virtualization/install-vmware-host/?referrer=grok.com", "publisher": "KALI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kali.org", "key": "publisher-domain:kali.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Building an Extremely Vulnerable Windows 10 Lab: A Step-by-Step Guide (Bonus :Full PT with…", "url": "https://1200km.com/articles/read/2026/2026-01-05-building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:mandiant.com:749285850d40cd5d", "title": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft", "publisher": "Mandiant", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mandiant.com", "key": "publisher-domain:mandiant.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:mandiant.com:30e9424ec06a52b2", "title": "https://www.mandiant.com/resources/blog/apt41-us-state-governments", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.mandiant.com/resources/blog/apt41-us-state-governments", "publisher": "Mandiant", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mandiant.com", "key": "publisher-domain:mandiant.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:microsoft.com:347203fcbdeb4757", "title": "https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2019", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2019", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Active Directory Lab for PenTest. Manual Deployment Guide", "url": "https://1200km.com/articles/read/2026/2026-01-24-active-directory-lab-for-pentest-manual-deployment-guide-cab28cd4ad8d/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:microsoft.com:2f3520faa1e5ab82", "title": "https://www.microsoft.com/en-us/msrc/blog/2022/02/analysis-resources-cyber-threat-activity-ukraine", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/msrc/blog/2022/02/analysis-resources-cyber-threat-activity-ukraine", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:microsoft.com:86485d44944834c8", "title": "https://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:microsoft.com:e5db922319948a35", "title": "https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:microsoft.com:ab46bd4f873693e2", "title": "https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:microsoft.com:79764ee8a27087e9", "title": "https://www.microsoft.com/en-us/security/security-insider/threat-landscape/iran-surges-cyber-enabled-influence-operations-in-support-of-hamas", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.microsoft.com/en-us/security/security-insider/threat-landscape/iran-surges-cyber-enabled-influence-operations-in-support-of-hamas", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" }, { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:microsoft.com:1810609802b99350", "title": "https://www.microsoft.com/software-download/windows10?referrer=grok.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/software-download/windows10?referrer=grok.com", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Building an Extremely Vulnerable Windows 10 Lab: A Step-by-Step Guide (Bonus :Full PT with…", "url": "https://1200km.com/articles/read/2026/2026-01-05-building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:ncsc.gov.uk:5a0f13f3cc26d5ed", "title": "https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf", "publisher": "NCSC GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ncsc.gov.uk", "key": "publisher-domain:ncsc.gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:ncsc.gov.uk:c07df455d83c2ba3", "title": "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/infamous-chisel/NCSC-MAR-Infamous-Chisel.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/infamous-chisel/NCSC-MAR-Infamous-Chisel.pdf", "publisher": "NCSC GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ncsc.gov.uk", "key": "publisher-domain:ncsc.gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:nist.gov:995408544f495c8c", "title": "https://www.nist.gov/privacy-framework", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.nist.gov/privacy-framework", "publisher": "NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nist.gov", "key": "publisher-domain:nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:nist.gov:1454fd30ddbd036a", "title": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "publisher": "NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nist.gov", "key": "publisher-domain:nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:nlrb.gov:f7d954fbf9b0d94a", "title": "https://www.nlrb.gov/news-outreach/news-story/nlrb-general-counsel-issues-memo-on-electronic-monitoring", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.nlrb.gov/news-outreach/news-story/nlrb-general-counsel-issues-memo-on-electronic-monitoring", "publisher": "NLRB", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nlrb.gov", "key": "publisher-domain:nlrb.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:oaic.gov.au:e60848cb2c926cdd", "title": "https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/workplace-privacy/employee-records-exemption", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/workplace-privacy/employee-records-exemption", "publisher": "OAIC GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "oaic.gov.au", "key": "publisher-domain:oaic.gov.au" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:openpolicyagent.org:37a0a24cac2dd1a5", "title": "https://www.openpolicyagent.org/docs/latest", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.openpolicyagent.org/docs/latest", "publisher": "Openpolicyagent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "openpolicyagent.org", "key": "publisher-domain:openpolicyagent.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:picussecurity.com:ec73352ab5665772", "title": "https://www.picussecurity.com/resource/blog/inside-sandworm-decade-of-cyber-sabotage-and-espionage-activity", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.picussecurity.com/resource/blog/inside-sandworm-decade-of-cyber-sabotage-and-espionage-activity", "publisher": "Picussecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "picussecurity.com", "key": "publisher-domain:picussecurity.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:progress.com:60de6397433debe9", "title": "https://www.progress.com/security", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.progress.com/security", "publisher": "Progress", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "progress.com", "key": "publisher-domain:progress.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:recordedfuture.com:2caf7a88a84faf87", "title": "https://www.recordedfuture.com/blog/retaliation-window-middle-east-escalation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.recordedfuture.com/blog/retaliation-window-middle-east-escalation", "publisher": "Recordedfuture", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:recordedfuture.com:60e4bbf971e47e15", "title": "https://www.recordedfuture.com/chinese-state-sponsored-group-tag-22-targets-nepal-philippines-taiwan", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.recordedfuture.com/chinese-state-sponsored-group-tag-22-targets-nepal-philippines-taiwan", "publisher": "Recordedfuture", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:rusi.org:1607e0ef552ed666", "title": "https://www.rusi.org/explore-our-research/publications/commentary/russias-cyber-campaign-shifts-ukraines-frontlines", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.rusi.org/explore-our-research/publications/commentary/russias-cyber-campaign-shifts-ukraines-frontlines", "publisher": "RUSI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "rusi.org", "key": "publisher-domain:rusi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:securityjoes.com:5bb23693845c9a54", "title": "https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group", "publisher": "Securityjoes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "securityjoes.com", "key": "publisher-domain:securityjoes.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:sentinelone.com:504f17b90e74a878", "title": "https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine", "publisher": "Sentinelone", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:sophos.com:f269ad6a5d36fd2a", "title": "https://www.sophos.com/en-us/threat-profiles/cobalt-mystique", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sophos.com/en-us/threat-profiles/cobalt-mystique", "publisher": "Sophos", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sophos.com", "key": "publisher-domain:sophos.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:specterops.io:61cbba4d8b8c4d6a", "title": "https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf", "publisher": "Specterops", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "specterops.io", "key": "publisher-domain:specterops.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "ADCS ESC8 Attack: Certificate-Based Domain Compromise — Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-01-28-adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:supremecourt.uk:445df3be29f1ecf4", "title": "https://www.supremecourt.uk/cases/uksc-2018-0090.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.supremecourt.uk/cases/uksc-2018-0090.html", "publisher": "Supremecourt", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "supremecourt.uk", "key": "publisher-domain:supremecourt.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:terraform.io:3b6786f5d9fd8775", "title": "https://www.terraform.io/docs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.terraform.io/docs", "publisher": "Terraform", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "terraform.io", "key": "publisher-domain:terraform.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:terraform.io:3205e52daa60c6e1", "title": "https://www.terraform.io/downloads", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.terraform.io/downloads", "publisher": "Terraform", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "terraform.io", "key": "publisher-domain:terraform.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable Cloud Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-03-13-building-a-vulnerable-cloud-pentest-lab-with-terraform-9858ac96b29e/", "type": "article", "domain": "cloud-security" }, { "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:threatfabric.com:6e6cb87327dad7cc", "title": "https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld", "publisher": "Threatfabric", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "threatfabric.com", "key": "publisher-domain:threatfabric.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:timesofisrael.com:52563974fcc811cc", "title": "https://www.timesofisrael.com/iranian-hackers-broadcast-rocket-sirens-odes-to-terrorism-in-some-20-kindergartens", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.timesofisrael.com/iranian-hackers-broadcast-rocket-sirens-odes-to-terrorism-in-some-20-kindergartens", "publisher": "Timesofisrael", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "timesofisrael.com", "key": "publisher-domain:timesofisrael.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:unpac.me:e57153dc0e6f3ffa", "title": "https://www.unpac.me", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.unpac.me", "publisher": "Unpac", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unpac.me", "key": "publisher-domain:unpac.me" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "SPW AW25 — PO.010 SMS.exe.exe (AgentTesla)", "url": "https://1200km.com/articles/read/2025/2025-03-24-spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295/", "type": "article", "domain": "malware-analysis" }, { "title": "Static Malware Analysis . Obfuscation.", "url": "https://1200km.com/articles/read/2025/2025-03-30-static-malware-analysis-obfuscation-51de3992065d/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:vagrantup.com:d24d91b81d2d38cc", "title": "https://www.vagrantup.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.vagrantup.com", "publisher": "Vagrantup", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "vagrantup.com", "key": "publisher-domain:vagrantup.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Deploy a Complete Active Directory PenTest Lab in One Prompt with Cursor AI", "url": "https://1200km.com/articles/read/2026/2026-01-23-deploy-a-complete-active-directory-pentest-lab-in-one-prompt-with-cursor-ai-ff926fd2b3fc/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:virtualbox.org:86fd1893b0afcc1d", "title": "https://www.virtualbox.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.virtualbox.org", "publisher": "Virtualbox", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "virtualbox.org", "key": "publisher-domain:virtualbox.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Deploy a Complete Active Directory PenTest Lab in One Prompt with Cursor AI", "url": "https://1200km.com/articles/read/2026/2026-01-23-deploy-a-complete-active-directory-pentest-lab-in-one-prompt-with-cursor-ai-ff926fd2b3fc/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:virtualbox.org:e8cd0bb7cc39e85d", "title": "https://www.virtualbox.org/?referrer=grok.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.virtualbox.org/?referrer=grok.com", "publisher": "Virtualbox", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "virtualbox.org", "key": "publisher-domain:virtualbox.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Building an Extremely Vulnerable Windows 10 Lab: A Step-by-Step Guide (Bonus :Full PT with…", "url": "https://1200km.com/articles/read/2026/2026-01-05-building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:virtualbox.org:2f6fc4d9ff13d2f1", "title": "https://www.virtualbox.org/%3E?referrer=grok.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.virtualbox.org/%3E?referrer=grok.com", "publisher": "Virtualbox", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "virtualbox.org", "key": "publisher-domain:virtualbox.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Building an Extremely Vulnerable Ubuntu 24.04 Server Lab (Bonus: Full PT with Hexstrike)", "url": "https://1200km.com/articles/read/2026/2026-01-06-building-an-extremely-vulnerable-ubuntu-24-04-server-lab-bonus-full-pt-with-hexstrike-90034032775b/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:virustotal.com:c7be91c921edc1f5", "title": "https://www.virustotal.com/gui/domain/example.com/details", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.virustotal.com/gui/domain/example.com/details", "publisher": "Virustotal", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "virustotal.com", "key": "publisher-domain:virustotal.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:vmware.com:922a1634cfcb3fba", "title": "https://www.vmware.com/products/workstation-player.html?referrer=grok.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.vmware.com/products/workstation-player.html?referrer=grok.com", "publisher": "Vmware", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "vmware.com", "key": "publisher-domain:vmware.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Building an Extremely Vulnerable Windows 10 Lab: A Step-by-Step Guide (Bonus :Full PT with…", "url": "https://1200km.com/articles/read/2026/2026-01-05-building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:vmware.com:537a5b08bd67e960", "title": "https://www.vmware.com/products/workstation-player.html%3E?referrer=grok.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.vmware.com/products/workstation-player.html%3E?referrer=grok.com", "publisher": "Vmware", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "vmware.com", "key": "publisher-domain:vmware.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Building an Extremely Vulnerable Ubuntu 24.04 Server Lab (Bonus: Full PT with Hexstrike)", "url": "https://1200km.com/articles/read/2026/2026-01-06-building-an-extremely-vulnerable-ubuntu-24-04-server-lab-bonus-full-pt-with-hexstrike-90034032775b/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:welivesecurity.com:dfbbf660d6db3ab1", "title": "https://www.welivesecurity.com/2022/05/20/sandworm-ukraine-new-version-arguepatch-malware-loader", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.welivesecurity.com/2022/05/20/sandworm-ukraine-new-version-arguepatch-malware-loader", "publisher": "Welivesecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "welivesecurity.com", "key": "publisher-domain:welivesecurity.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:welivesecurity.com:d3033d837b969d16", "title": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution", "publisher": "Welivesecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "welivesecurity.com", "key": "publisher-domain:welivesecurity.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:wsj.com:71b59b01f68f8f23", "title": "https://www.wsj.com/world/middle-east/iran-hacks-former-israeli-prime-minister-in-new-tehran-linked-cyberattack-f1a959ca", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.wsj.com/world/middle-east/iran-hacks-former-israeli-prime-minister-in-new-tehran-linked-cyberattack-f1a959ca", "publisher": "WSJ", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "wsj.com", "key": "publisher-domain:wsj.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:xpolog.atlassian.net:f5df3832efcaddeb", "title": "https://xpolog.atlassian.net/wiki/spaces/XPOL/overview", "description": "External source cited by 1 maintained 1200km page.", "url": "https://xpolog.atlassian.net/wiki/spaces/XPOL/overview", "publisher": "Xpolog Atlassian", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "xpolog.atlassian.net", "key": "publisher-domain:xpolog.atlassian.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:act.globalcyberalliance.org:34aae850335f8e6f", "title": "Hutchins, Cloppert, and Amin, 2011", "description": "External source cited by 1 maintained 1200km page.", "url": "https://act.globalcyberalliance.org/index.php/Intelligence-Driven_Computer_Network_Defense_Informed_by_Analysis_of_Adversary_Campaigns_and_Intrusion_Kill_Chains", "publisher": "ACT Globalcyberalliance", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "act.globalcyberalliance.org", "key": "publisher-domain:act.globalcyberalliance.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:lockheedmartin.com:b7f23135fe7f1349", "title": "Hutchins, Cloppert, and Amin, Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf", "publisher": "Lockheedmartin", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "lockheedmartin.com", "key": "publisher-domain:lockheedmartin.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "ai-attack-reference:pub-113", "title": "Hype vs. Reality: AI in the Cybercriminal Underground", "description": "Trend Micro threat-research report covering Deepfake video or image, Malware development, and Deepfake impersonation. Indexed with Google context.", "url": "https://www.trendaisecurity.com/pl/resources-insights/deep-research/hype-vs-reality-ai-in-the-cybercriminal-underground", "publisher": "Trend Micro", "published_at": "2023-04-17", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$100 · medium confidence", "key": "metric:100-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$110 · medium confidence", "key": "metric:110-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$200 · medium confidence", "key": "metric:200-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$90 · medium confidence", "key": "metric:90-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "€5,000. · medium confidence", "key": "metric:5-000.-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "€550 · medium confidence", "key": "metric:550-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "US$10. · medium confidence", "key": "metric:us-10.-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "US$500, b · medium confidence", "key": "metric:us-500-b-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "US$90 · medium confidence", "key": "metric:us-90-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM model", "type": "llm_model", "value": "Llama", "key": "llm-model:llama" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Meta", "key": "llm-provider:meta" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "DarkBERT", "key": "malicious-ai-tool:darkbert" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "Evil-GPT", "key": "malicious-ai-tool:evil-gpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Trend Micro", "key": "publisher:trend-micro" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "trendaisecurity.com", "key": "publisher-domain:trendaisecurity.com" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "trendmicro.com", "key": "publisher-domain:trendmicro.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "Year", "type": "year", "value": "2023", "key": "year:2023" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-102", "title": "I Have No Mouth, and I Must Do Crime | Recorded Future", "description": "Recorded Future threat-research report covering Deepfake video or image, Deepfake voice, and Identity fraud and impersonation.", "url": "https://www.recordedfuture.com/research/i-have-no-mouth-and-i-must-do-crime", "publisher": "Recorded Future", "published_at": "2023-01-26", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "elevenlabs[.]io", "key": "ioc:elevenlabs-.-io" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Recorded Future", "key": "publisher:recorded-future" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2023", "key": "year:2023" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-101", "title": "I, Chatbot | Recorded Future", "description": "Recorded Future threat-research report covering Influence operations, Malware development, and Translation and localization. Indexed with Media and OpenAI context.", "url": "https://www.recordedfuture.com/research/i-chatbot", "publisher": "Recorded Future", "published_at": "2022-11-30", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Malicious advertisement", "key": "attack-vector:malicious-advertisement" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Recorded Future", "key": "publisher:recorded-future" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Media", "key": "sector:media" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Target", "type": "target", "value": "Security researchers", "key": "target:security-researchers" }, { "facet": "TTP", "type": "ttp", "value": "Malicious advertising", "key": "ttp:malicious-advertising" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "Year", "type": "year", "value": "2022", "key": "year:2022" } ], "used_in": [] }, { "id": "site-reference:iafci.org:f5c9c5754b03d2d6", "title": "iafci.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.iafci.org/MembersOnly/Federal_Agencies/2022_Annual_Internet_Crime_Report_IC3.aspx", "publisher": "Iafci", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "iafci.org", "key": "publisher-domain:iafci.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:ibm.com:eb9eb1b74bd70224", "title": "IBM Cost of a Data Breach Report 2024", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ibm.com/reports/data-breach", "publisher": "IBM", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ibm.com", "key": "publisher-domain:ibm.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:ibm.com:149ec5e82c7cf6f3", "title": "IBM X-Force, AI vs. human deceit: Unravelling the new age of phishing tactics", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ibm.com/think/x-force/ai-vs-human-deceit-unravelling-new-age-phishing-tactics", "publisher": "IBM", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ibm.com", "key": "publisher-domain:ibm.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:ibm.com:de70bc01f9cf4812", "title": "ibm.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ibm.com/think/x-force/2023-x-force-threat-intelligence-index-report", "publisher": "IBM", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ibm.com", "key": "publisher-domain:ibm.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:icann.org:f0888e270663d4c8", "title": "ICANN — Registration Data Access Protocol", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.icann.org/rdap", "publisher": "Icann", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "icann.org", "key": "publisher-domain:icann.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:cisa.gov:f8e28bbc4aefcc28", "title": "ICS advisories index", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/ics-advisories", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "ai-attack-reference:pub-084", "title": "Impact of AI on cyber threat from now to 2027 | National Cyber Security Centre", "description": "UK Government provider or government report covering Exploit development, Influence operations, and Malware development. Indexed with Education context.", "url": "https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027", "publisher": "UK Government", "published_at": "2025-05-07", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Disruption / destruction", "key": "actor-motivation:disruption-/-destruction" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "UK Government", "key": "publisher:uk-government" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "ncsc.gov.uk", "key": "publisher-domain:ncsc.gov.uk" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-033", "title": "Impersonated GenAI Site Lures Victims to Infostealer Download - Check Point Research", "description": "Check Point provider or government report covering Identity fraud and impersonation, Obfuscation and evasion, and Command and control. Indexed with Cryptocurrency and Google context.", "url": "https://research.checkpoint.com/2025/impersonated-kling-ai-site-installs-malware/", "publisher": "Check Point", "published_at": "2025-05-20", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Fake AI website", "key": "attack-vector:fake-ai-website" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Malicious advertisement", "key": "attack-vector:malicious-advertisement" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "ai-kling[.]com", "key": "ioc:ai-kling-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "facebook[.]com", "key": "ioc:facebook-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "kingaimediapro[.]com", "key": "ioc:kingaimediapro-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "kingaiplus[.]com", "key": "ioc:kingaiplus-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "kingaitext[.]com", "key": "ioc:kingaitext-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "kingaivideotext[.]com", "key": "ioc:kingaivideotext-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "klingaieditor[.]com", "key": "ioc:klingaieditor-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "klingaimedia[.]com", "key": "ioc:klingaimedia-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "klingaistudio[.]com", "key": "ioc:klingaistudio-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "klings-ai[.]com", "key": "ioc:klings-ai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "klingturbo[.]com", "key": "ioc:klingturbo-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "klingxai[.]com", "key": "ioc:klingxai-.-com" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "06d9d60ddbe835abc5b16911a35732cc9b56ea9425de210961a15d465823978f", "key": "ioc:06d9d60ddbe835abc5b16911a35732cc9b56ea9425de210961a15d465823978f" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "0c9228983fbd928ac94c057a00d744d6be4bd4c1b39d1465b7d955b7d35bf496", "key": "ioc:0c9228983fbd928ac94c057a00d744d6be4bd4c1b39d1465b7d955b7d35bf496" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "1e66ebaef295c2a32245162979d167cebad1fece51b7cdb6a6c3a1d705befa6b", "key": "ioc:1e66ebaef295c2a32245162979d167cebad1fece51b7cdb6a6c3a1d705befa6b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "2588fdfa7417d617df2d31eddea710d0f964008abc2f4860cdff588ab9786d0a", "key": "ioc:2588fdfa7417d617df2d31eddea710d0f964008abc2f4860cdff588ab9786d0a" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "2d5e01cfacdf9f900b51b0539e0809f22ce1859eac0886866af35a2eb2dc2d42", "key": "ioc:2d5e01cfacdf9f900b51b0539e0809f22ce1859eac0886866af35a2eb2dc2d42" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "30e26f4fd7cb0ac626950bb01e01a2c02e277727d1d3ec94286a44af262f37cf", "key": "ioc:30e26f4fd7cb0ac626950bb01e01a2c02e277727d1d3ec94286a44af262f37cf" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "39d771c12bd5da15d3fb63905df1e2c4c7c12b8f77c630a35b247c418950eafe", "key": "ioc:39d771c12bd5da15d3fb63905df1e2c4c7c12b8f77c630a35b247c418950eafe" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "3fba4a0942244e9c3ad25a57a21f91b06f8732a2ca36da948ae5f0afa51dc72b", "key": "ioc:3fba4a0942244e9c3ad25a57a21f91b06f8732a2ca36da948ae5f0afa51dc72b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "4bbaf3ececd53bc4028723e87b1669268a6fadc4d480590c2d59bb4322a17de7", "key": "ioc:4bbaf3ececd53bc4028723e87b1669268a6fadc4d480590c2d59bb4322a17de7" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "5200b27726c0be8e6f34a3920fbd5d40aeaec460169b1f3c7a174ebeee6553d9", "key": "ioc:5200b27726c0be8e6f34a3920fbd5d40aeaec460169b1f3c7a174ebeee6553d9" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "557becfcc7eccaa5a7368a6d5583404af26aadede2c345d6070e6e9fab44a641", "key": "ioc:557becfcc7eccaa5a7368a6d5583404af26aadede2c345d6070e6e9fab44a641" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "699e348260ae5b60cd822325f1c4bf2c793f6f25001357856c58520a9af10987", "key": "ioc:699e348260ae5b60cd822325f1c4bf2c793f6f25001357856c58520a9af10987" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "7035b5ba24146db537eedb1f05e6cad1775f9f5e81306f72422c03b288f75448", "key": "ioc:7035b5ba24146db537eedb1f05e6cad1775f9f5e81306f72422c03b288f75448" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "732aa8ed8ca9a12f4bfc29a693ec3eba74ed1b2d00de4296180d91b86d09747b", "key": "ioc:732aa8ed8ca9a12f4bfc29a693ec3eba74ed1b2d00de4296180d91b86d09747b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "839371cd5a5d66828ac9524182769371dede9606826ad7c22c3bb18fb2ee91cb", "key": "ioc:839371cd5a5d66828ac9524182769371dede9606826ad7c22c3bb18fb2ee91cb" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "9dab2badfdae86963b2f13ce8942fe78dd66ec497f8d82dd40c0cb5bec4fb2a7", "key": "ioc:9dab2badfdae86963b2f13ce8942fe78dd66ec497f8d82dd40c0cb5bec4fb2a7" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "a5baceb97a2be17fdd0c282292ebb0b5a56a555013a4c8fffcc2335c504780fb", "key": "ioc:a5baceb97a2be17fdd0c282292ebb0b5a56a555013a4c8fffcc2335c504780fb" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b33e162a78b7b8e7dbbab5d1572d63814077fa524067ce79c37f52441b8bd384", "key": "ioc:b33e162a78b7b8e7dbbab5d1572d63814077fa524067ce79c37f52441b8bd384" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "beeea592251a0a205b3bdb34802bd2f4f5181ee38226a05ec468a86be44e9508", "key": "ioc:beeea592251a0a205b3bdb34802bd2f4f5181ee38226a05ec468a86be44e9508" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "cee3f98b5f175219d025a92eddec4fd8bcaae31e6ad99321ae7c00b822063fc3", "key": "ioc:cee3f98b5f175219d025a92eddec4fd8bcaae31e6ad99321ae7c00b822063fc3" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "d1b712b215612c8df5fef02b614c616a78b723bffbec6e10e32bfd0b758df41b", "key": "ioc:d1b712b215612c8df5fef02b614c616a78b723bffbec6e10e32bfd0b758df41b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "d95b3eabfe9892371cb518fd6e733d2d33d2fabb2b1df4dab650a8f8e1ea8745", "key": "ioc:d95b3eabfe9892371cb518fd6e733d2d33d2fabb2b1df4dab650a8f8e1ea8745" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "f5b31bd394e0a3adb6bd175207b8c3ccc51850c8f2cee1149a8421736168e13e", "key": "ioc:f5b31bd394e0a3adb6bd175207b8c3ccc51850c8f2cee1149a8421736168e13e" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "f89298933fed52511bb78f8f377979190e37367d72ccf4f3b81374a70362cc42", "key": "ioc:f89298933fed52511bb78f8f377979190e37367d72ccf4f3b81374a70362cc42" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PureHVNC RAT", "key": "malware-or-tool:purehvnc-rat" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Check Point", "key": "publisher:check-point" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Security researchers", "key": "target:security-researchers" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Fake website or service", "key": "ttp:fake-website-or-service" }, { "facet": "TTP", "type": "ttp", "value": "Malicious advertising", "key": "ttp:malicious-advertising" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:welivesecurity.com:b127eeaffe8660dc", "title": "Industroyer: Biggest threat to industrial control systems since Stuxnet *ESET has analyzed a sophisticated and extremely dangerous malware, known as Industroyer, which is designed to disrupt…*www.welivesecurity.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet", "publisher": "Welivesecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "welivesecurity.com", "key": "publisher-domain:welivesecurity.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:welivesecurity.com:10ef13ea10c654dd", "title": "Industroyer2: Industroyer reloaded *ESET researchers have responded to a cyber-incident that affected an energy provider in Ukraine and involved…*www.welivesecurity.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded", "publisher": "Welivesecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "welivesecurity.com", "key": "publisher-domain:welivesecurity.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:inetsim.org:addd2f4af3a6c45c", "title": "INetSim official documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.inetsim.org/documentation.html", "publisher": "Inetsim", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "inetsim.org", "key": "publisher-domain:inetsim.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "How to Build a Safe Malware Analysis Lab with FLARE-VM, REMnux, and INetSim", "url": "https://1200km.com/articles/read/2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:inetsim.org:84d112cad4b4a897", "title": "INetSim official feature overview", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.inetsim.org/features.html", "publisher": "Inetsim", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "inetsim.org", "key": "publisher-domain:inetsim.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "How to Build a Safe Malware Analysis Lab with FLARE-VM, REMnux, and INetSim", "url": "https://1200km.com/articles/read/2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:cisa.gov:37b739463fbc5abe", "title": "Infamous Chisel Malware Analysis Report | CISA *Infamous Chisel is a collection of components targeting Android devices. This malware is associated with Sandworm…*www.cisa.gov", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/news-events/analysis-reports/ar23-243a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:infosecurity-magazine.com:313e6d579341f9be", "title": "infosecurity-magazine.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.infosecurity-magazine.com/news/94-firms-hit-phishing-attacks-2023", "publisher": "Infosecurity Magazine", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "infosecurity-magazine.com", "key": "publisher-domain:infosecurity-magazine.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:techcommunity.microsoft.com:41a014fdefd160bf", "title": "Initial Access Techniques in Kubernetes Environments Used by Kinsing Malware | Microsoft Defender for Cloud Blog", "description": "External source cited by 1 maintained 1200km page.", "url": "https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/initial-access-techniques-in-kubernetes-environments-used-by-kinsing-malware/3697975", "publisher": "Techcommunity Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "techcommunity.microsoft.com", "key": "publisher-domain:techcommunity.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:medium.com:2e7a4c6896928ccd", "title": "Insider guide", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" } ] }, { "id": "site-reference:instagram.com:dbad0a092553e93b", "title": "Instagram", "description": "External source cited by 1 maintained 1200km page.", "url": "https://instagram.com/sunilsandhu", "publisher": "Instagram", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "instagram.com", "key": "publisher-domain:instagram.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:intel471.com:fc6b1f4c91215c5d", "title": "Intel 471", "description": "External source cited by 1 maintained 1200km page.", "url": "https://intel471.com", "publisher": "Intel471", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "intel471.com", "key": "publisher-domain:intel471.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:go.intel471.com:898fb29fb5521090", "title": "Intel 471 — HUNTER Iranian Threat Actor Coverage PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://go.intel471.com/hubfs/Emerging%20Threats/2025%20Emerging%20Threats/Upd%20HUNTER%20-%20Iranian%20Threat%20Actor%20Coverage.pdf", "publisher": "GO Intel471", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "go.intel471.com", "key": "publisher-domain:go.intel471.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:intel.com:5579173807c073f4", "title": "Intel Downfall / Gather Data Sampling / CVE-2022–40982", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/gather-data-sampling.html", "publisher": "Intel", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "intel.com", "key": "publisher-domain:intel.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:intel.com:08d67a9f8836a781", "title": "Intel® 64 and IA-32 Architectures Software Developer Manuals", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html", "publisher": "Intel", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "intel.com", "key": "publisher-domain:intel.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "ai-attack-reference:pub-074", "title": "International scientific report on the safety of advanced AI: interim report - GOV.UK", "description": "UK Government forecast or strategic assessment covering Deepfake video or image, Deepfake voice, and Identity fraud and impersonation. Indexed with Artificial Intelligence and Anthropic context.", "url": "https://www.gov.uk/government/publications/international-scientific-report-on-the-safety-of-advanced-ai/international-scientific-report-on-the-safety-of-advanced-ai-interim-report", "publisher": "UK Government", "published_at": "2025-10-22", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Computer vision / OCR", "key": "ai-technology:computer-vision-/-ocr" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "European Union", "key": "country-or-region:european-union" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "10 Countries · medium confidence", "key": "metric:10-countries-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "3 system · medium confidence", "key": "metric:3-system-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "30 countries · medium confidence", "key": "metric:30-countries-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "10 years · medium confidence", "key": "metric:10-years-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "15 years · medium confidence", "key": "metric:15-years-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "16 months · medium confidence", "key": "metric:16-months-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "2 months · medium confidence", "key": "metric:2-months-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "2 years · medium confidence", "key": "metric:2-years-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "20 months · medium confidence", "key": "metric:20-months-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "3 years · medium confidence", "key": "metric:3-years-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "5 years · medium confidence", "key": "metric:5-years-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "50 days · medium confidence", "key": "metric:50-days-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "6 months · medium confidence", "key": "metric:6-months-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "8 months · medium confidence", "key": "metric:8-months-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$15,000 · medium confidence", "key": "metric:15-000-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$700k · medium confidence", "key": "metric:700k-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.5% · medium confidence", "key": "metric:1.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1% · medium confidence", "key": "metric:1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10% · medium confidence", "key": "metric:10-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "135% · medium confidence", "key": "metric:135-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2% · medium confidence", "key": "metric:2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "21% · medium confidence", "key": "metric:21-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "22% · medium confidence", "key": "metric:22-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "26% · medium confidence", "key": "metric:26-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3% · medium confidence", "key": "metric:3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "30% · medium confidence", "key": "metric:30-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "38% · medium confidence", "key": "metric:38-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4% · medium confidence", "key": "metric:4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "40% · medium confidence", "key": "metric:40-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "42.5% · medium confidence", "key": "metric:42.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "50% · medium confidence", "key": "metric:50-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "54% · medium confidence", "key": "metric:54-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "60% · medium confidence", "key": "metric:60-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "80% · medium confidence", "key": "metric:80-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "84.3% · medium confidence", "key": "metric:84.3-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "IOC · Ipv4", "type": "ioc", "value": "5.2.1.1", "key": "ioc:5.2.1.1" }, { "facet": "IOC · Ipv4", "type": "ioc", "value": "5.2.1.2", "key": "ioc:5.2.1.2" }, { "facet": "IOC · Ipv4", "type": "ioc", "value": "5.2.3.2", "key": "ioc:5.2.3.2" }, { "facet": "IOC · Md5", "type": "ioc", "value": "075b051ec3d22dac7b33f788da631fd4", "key": "ioc:075b051ec3d22dac7b33f788da631fd4" }, { "facet": "IOC · Md5", "type": "ioc", "value": "077e29b11be80ab57e1a2ecabb7da330", "key": "ioc:077e29b11be80ab57e1a2ecabb7da330" }, { "facet": "IOC · Md5", "type": "ioc", "value": "1457c0d6bfcb4967418bfb8ac142f64a", "key": "ioc:1457c0d6bfcb4967418bfb8ac142f64a" }, { "facet": "IOC · Md5", "type": "ioc", "value": "294a8ed24b1ad22ec2e7efea049b8737", "key": "ioc:294a8ed24b1ad22ec2e7efea049b8737" }, { "facet": "IOC · Md5", "type": "ioc", "value": "3c44405d619a6920384a45bce876b41e", "key": "ioc:3c44405d619a6920384a45bce876b41e" }, { "facet": "IOC · Md5", "type": "ioc", "value": "3f5ee243547dee91fbd053c1c4a845aa", "key": "ioc:3f5ee243547dee91fbd053c1c4a845aa" }, { "facet": "IOC · Md5", "type": "ioc", "value": "41c542dfe6e4fc3deb251d64cf6ed2e4", "key": "ioc:41c542dfe6e4fc3deb251d64cf6ed2e4" }, { "facet": "IOC · Md5", "type": "ioc", "value": "4496bf24afe7fab6f046bf4923da8de6", "key": "ioc:4496bf24afe7fab6f046bf4923da8de6" }, { "facet": "IOC · Md5", "type": "ioc", "value": "462211f67c7d858f663355eff93b745e", "key": "ioc:462211f67c7d858f663355eff93b745e" }, { "facet": "IOC · Md5", "type": "ioc", "value": "61d77652c97ef636343742fc3dcf3ba9", "key": "ioc:61d77652c97ef636343742fc3dcf3ba9" }, { "facet": "IOC · Md5", "type": "ioc", "value": "65699726a3c601b9f31bf04019c8593c", "key": "ioc:65699726a3c601b9f31bf04019c8593c" }, { "facet": "IOC · Md5", "type": "ioc", "value": "6b493230205f780e1bc26945df7481e5", "key": "ioc:6b493230205f780e1bc26945df7481e5" }, { "facet": "IOC · Md5", "type": "ioc", "value": "757b505cfd34c64c85ca5b5690ee5293", "key": "ioc:757b505cfd34c64c85ca5b5690ee5293" }, { "facet": "IOC · Md5", "type": "ioc", "value": "9d2682367c3935defcb1f9e247a97c0d", "key": "ioc:9d2682367c3935defcb1f9e247a97c0d" }, { "facet": "IOC · Md5", "type": "ioc", "value": "9d5609613524ecf4f15af0f7b31abca4", "key": "ioc:9d5609613524ecf4f15af0f7b31abca4" }, { "facet": "IOC · Md5", "type": "ioc", "value": "9d89448b63ce1e2e8dc7af72c984c196", "key": "ioc:9d89448b63ce1e2e8dc7af72c984c196" }, { "facet": "IOC · Md5", "type": "ioc", "value": "ad1f8bb9b51f023cdc80cf94bb615aa9", "key": "ioc:ad1f8bb9b51f023cdc80cf94bb615aa9" }, { "facet": "IOC · Md5", "type": "ioc", "value": "adf7ee2dcf142b0e11888e72b43fcb75", "key": "ioc:adf7ee2dcf142b0e11888e72b43fcb75" }, { "facet": "IOC · Md5", "type": "ioc", "value": "b8b9c74ac526fffbeb2d39ab038d1cd7", "key": "ioc:b8b9c74ac526fffbeb2d39ab038d1cd7" }, { "facet": "IOC · Md5", "type": "ioc", "value": "c26820b8a4c1b3c2aa868d6d57e14a79", "key": "ioc:c26820b8a4c1b3c2aa868d6d57e14a79" }, { "facet": "IOC · Md5", "type": "ioc", "value": "c74956ffb38ba48ed6ce977af6727275", "key": "ioc:c74956ffb38ba48ed6ce977af6727275" }, { "facet": "IOC · Md5", "type": "ioc", "value": "d76d8deea9c19cc9aaf2237d2bf2f785", "key": "ioc:d76d8deea9c19cc9aaf2237d2bf2f785" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "de8ba9b01c9ab7cbabf5c33b80b7bbc618857627", "key": "ioc:de8ba9b01c9ab7cbabf5c33b80b7bbc618857627" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM model", "type": "llm_model", "value": "Llama", "key": "llm-model:llama" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM model", "type": "llm_model", "value": "Mistral / Mixtral", "key": "llm-model:mistral-/-mixtral" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Meta", "key": "llm-provider:meta" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Mistral AI", "key": "llm-provider:mistral-ai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "xAI", "key": "llm-provider:xai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "UK Government", "key": "publisher:uk-government" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.uk", "key": "publisher-domain:gov.uk" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat assessment, forecast, or red-team study", "key": "relevance-basis:threat-assessment-forecast-or-red-team-study" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Artificial Intelligence", "key": "sector:artificial-intelligence" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Energy", "key": "sector:energy" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Healthcare", "key": "sector:healthcare" }, { "facet": "Sector", "type": "sector", "value": "Hospitality", "key": "sector:hospitality" }, { "facet": "Sector", "type": "sector", "value": "Legal Services", "key": "sector:legal-services" }, { "facet": "Sector", "type": "sector", "value": "Nonprofit / NGO", "key": "sector:nonprofit-/-ngo" }, { "facet": "Sector", "type": "sector", "value": "Technology", "key": "sector:technology" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "forecast or strategic assessment", "key": "source-type:forecast-or-strategic-assessment" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_only", "key": "statistical-use:context-only" }, { "facet": "Target", "type": "target", "value": "AI researchers and experts", "key": "target:ai-researchers-and-experts" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-078", "title": "Internet Crime Complaint Center (IC3) | Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud", "description": "FBI IC3 government or law-enforcement publication covering Identity fraud and impersonation, Phishing link or attachment, and Spearphishing. Indexed with Cryptocurrency context.", "url": "https://www.ic3.gov/PSA/2024/PSA241203", "publisher": "FBI IC3", "published_at": "2024-12-03", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "FBI IC3", "key": "publisher:fbi-ic3" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "ic3.gov", "key": "publisher-domain:ic3.gov" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "official advisory, fraud alert, or regional threat report", "key": "relevance-basis:official-advisory-fraud-alert-or-regional-threat-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "government or law-enforcement publication", "key": "source-type:government-or-law-enforcement-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_incident", "key": "statistical-use:context-or-incident" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-079", "title": "INTERPOL report finds AI linked to more than half of cybercrime in Africa", "description": "INTERPOL government or law-enforcement publication covering Deepfake video or image, Reconnaissance and target research, and Business email compromise. Indexed with Financial Services context.", "url": "https://www.interpol.int/News-and-Events/News/2026/INTERPOL-report-finds-AI-linked-to-more-than-half-of-cybercrime-in-Africa", "publisher": "INTERPOL", "published_at": "2026-08-03", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Contender", "key": "campaign:operation-contender" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Red Card", "key": "campaign:operation-red-card" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Sentinel", "key": "campaign:operation-sentinel" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Serengeti", "key": "campaign:operation-serengeti" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "17 countries · medium confidence", "key": "metric:17-countries-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "INTERPOL", "key": "publisher:interpol" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "interpol.int", "key": "publisher-domain:interpol.int" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "official advisory, fraud alert, or regional threat report", "key": "relevance-basis:official-advisory-fraud-alert-or-regional-threat-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Media", "key": "sector:media" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "government or law-enforcement publication", "key": "source-type:government-or-law-enforcement-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_incident", "key": "statistical-use:context-or-incident" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "site-reference:invariantlabs.ai:8bd28a29817fe007", "title": "Invariant Labs: MCP Tool Poisoning Attacks", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks", "publisher": "Invariantlabs", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "invariantlabs.ai", "key": "publisher-domain:invariantlabs.ai" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:first.org:25e2c0d7a4575606", "title": "ISAC / ISAO", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.first.org/members/teams", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:isc.sans.edu:f996c39907146072", "title": "isc.sans.edu", "description": "External source cited by 1 maintained 1200km page.", "url": "https://isc.sans.edu/diary/27244", "publisher": "ISC SANS", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "isc.sans.edu", "key": "publisher-domain:isc.sans.edu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "Endpoint Threat Hunting: Proactive Detection on Windows, Linux, and macOS", "url": "https://1200km.com/articles/read/2025/2025-12-14-endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:isms.online:50d8dbaa1a21e03c", "title": "isms.online", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.isms.online/iso-27001", "publisher": "ISMS", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "isms.online", "key": "publisher-domain:isms.online" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:iso.org:544f5fd8af43921b", "title": "ISO/IEC 23894 AI risk management", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.iso.org/standard/77304.html", "publisher": "ISO", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "iso.org", "key": "publisher-domain:iso.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:iso.org:dec3a8e1c85544ae", "title": "ISO/IEC 27000 family", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.iso.org/standard/iso-iec-27000-family", "publisher": "ISO", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "iso.org", "key": "publisher-domain:iso.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:iso.org:79a626b42677c5a8", "title": "ISO/IEC 27001:2022", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.iso.org/standard/27001", "publisher": "ISO", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "iso.org", "key": "publisher-domain:iso.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" }, { "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:iso.org:d41993ca6f1c5b62", "title": "ISO/IEC 42001 AI management systems", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.iso.org/standard/81230.html", "publisher": "ISO", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "iso.org", "key": "publisher-domain:iso.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:gov.il:e806b5f7272e95e3", "title": "Israel Ministry of Communications, Engineering Administration", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.il/en/departments/Units/arc", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.il", "key": "publisher-domain:gov.il" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:gov.il:0ece35a913299e6a", "title": "Israel National Cyber Directorate — MuddyWater / DarkBit PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.il/BlobFolder/news/_muddywater/en/government%20threat%20actor.pdf", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.il", "key": "publisher-domain:gov.il" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:gov.il:b12fc07f2ff338f3", "title": "Israel National Cyber Directorate — MuddyWater page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.il/en/pages/_muddywater", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.il", "key": "publisher-domain:gov.il" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:gov.il:ebbbe0aab27ef448", "title": "Israel National Cyber Directorate — Overview of Recent Phishing PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.il/BlobFolder/reports/alert_1947/he/ALERT-CERT-IL-W-1947.pdf", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.il", "key": "publisher-domain:gov.il" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:gov.il:88c037aea0b282a1", "title": "Israel National Cyber Directorate — Technological Advancement and Evolution of MuddyWater in 2024 PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.il/BlobFolder/reports/maddy_water_2024/en/ALERT_CERT_IL_W_1858.pdf", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.il", "key": "publisher-domain:gov.il" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:gov.il:eee40938dfdfd10c", "title": "Israel National Cyber Directorate, CERT-IL", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.il/he/departments/units/unit_cert_il", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.il", "key": "publisher-domain:gov.il" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:gov.il:a0fb0098de027884", "title": "Israel National Cyber Directorate, Iron Swords War in Cyber Sphere", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.gov.il/BlobFolder/reports/publish_2412/en/report2412en.pdf", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.il", "key": "publisher-domain:gov.il" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:itpro.com:acc80847a08d851c", "title": "ITPro: DeepSeek-powered pen-testing tool “Villager” could be a Cobalt Strike successor", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.itpro.com/technology/artificial-intelligence/this-deepseek-powered-pen-testing-tool-could-be-a-cobalt-strike-successor-and-hackers-have-downloaded-it-10-000-times-since-july", "publisher": "Itpro", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "itpro.com", "key": "publisher-domain:itpro.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Villager: The AI-Powered Penetration Testing Framework", "url": "https://1200km.com/articles/read/2025/2025-10-13-villager-the-ai-powered-penetration-testing-framework-8df10532e265/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cloud.google.com:984bb0871ac648c4", "title": "Ivanti CVE-2025–22457 / UNC5221", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:forums.ivanti.com:7a56f2292b35a7f6", "title": "Ivanti CVE-2025–22457 advisory", "description": "External source cited by 1 maintained 1200km page.", "url": "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457", "publisher": "Forums Ivanti", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "forums.ivanti.com", "key": "publisher-domain:forums.ivanti.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:sysdig.com:4ae9d38a8491b380", "title": "JADEPUFFER report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion", "publisher": "Sysdig", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sysdig.com", "key": "publisher-domain:sysdig.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cisa.gov:b4170ac67eaac201", "title": "Joint advisory AA24–038A, Volt Typhoon critical-infrastructure compromise", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" }, { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" }, { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:media.defense.gov:cef9338060c856ce", "title": "Joint Cyclops Blink advisory (PDF)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://media.defense.gov/2022/Feb/23/2002943421/-1/-1/0/CSA_NEW_SANDWORM_MALWARE_CYCLOPS_BLINK_REPLACES_VPNFILTER_20220223.PDF", "publisher": "Media Defense", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "media.defense.gov", "key": "publisher-domain:media.defense.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:journals.riverpublishers.com:8ea7e44194c09d78", "title": "journals.riverpublishers.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://journals.riverpublishers.com/index.php/JICTS/article/view/6405/5139", "publisher": "Journals Riverpublishers", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "journals.riverpublishers.com", "key": "publisher-domain:journals.riverpublishers.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:juniper.net:b50f78d290fbb138", "title": "juniper.net", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.juniper.net/content/dam/www/assets/white-papers/us/en/lte-security-for-mobile-service-provider-networks.pdf", "publisher": "Juniper", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "juniper.net", "key": "publisher-domain:juniper.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:kali.org:526596c91d10bfea", "title": "Kali Linux", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.kali.org/tools/hexstrike-ai", "publisher": "KALI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kali.org", "key": "publisher-domain:kali.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike MCP Orchestration with Ollama: Ubuntu Host, Kali VM, SSH Bridging, and Performance…", "url": "https://1200km.com/articles/read/2025/2025-12-31-hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:kali.org:17525c703083a53d", "title": "kali.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.kali.org/blog/kali-linux-2025-4-release", "publisher": "KALI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kali.org", "key": "publisher-domain:kali.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike AI: Install, Configure, and Run MCP with Gemini, OpenAI, Cursor, Llama", "url": "https://1200km.com/articles/read/2025/2025-12-18-hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:labs.withsecure.com:2458ac308057f4f6", "title": "Kapeka: A novel backdoor spotted in Eastern Europe *This report provides an in-depth technical analysis of the backdoor and its capabilities, and analyzes the connection…*labs.withsecure.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://labs.withsecure.com/publications/kapeka", "publisher": "LABS Withsecure", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "labs.withsecure.com", "key": "publisher-domain:labs.withsecure.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:ics-cert.kaspersky.com:508a901b85e0a2ef", "title": "Kaspersky ICS CERT — APT and financial attacks on industrial organizations in Q2 2024 PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ics-cert.kaspersky.com/wp-content/uploads/2024/10/kaspersky-ics-cert-apt-and-financial-attacks-on-industrial-organizations-in-q2-2024-en.pdf", "publisher": "ICS CERT Kaspersky", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ics-cert.kaspersky.com", "key": "publisher-domain:ics-cert.kaspersky.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:ics-cert.kaspersky.com:b66630da4c98d86a", "title": "Kaspersky ICS CERT — APT and financial attacks on industrial organizations in Q2 2025 PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ics-cert.kaspersky.com/wp-content/uploads/2025/09/kaspersky-ics-cert-apt-and-financial-attacks-on-industrial-organizations-in-q2-2025-en-2.pdf", "publisher": "ICS CERT Kaspersky", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ics-cert.kaspersky.com", "key": "publisher-domain:ics-cert.kaspersky.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-072", "title": "Key Takeaways from the 2025 Global Threat Landscape Report | FortiGuard Labs", "description": "Fortinet threat-research report covering Deepfake video or image, Malware development, and Reconnaissance and target research. Indexed with Artificial Intelligence context.", "url": "https://www.fortinet.com/blog/threat-research/key-takeaways-from-the-2025-global-threat-landscape-report", "publisher": "Fortinet", "published_at": "2025-04-28", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "CVE", "type": "cve", "value": "CVE-2017-0147", "key": "cve:cve-2017-0147" }, { "facet": "CVE", "type": "cve", "value": "CVE-2019-18935", "key": "cve:cve-2019-18935" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-44228", "key": "cve:cve-2021-44228" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11.6% · medium confidence", "key": "metric:11.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "16.7% · medium confidence", "key": "metric:16.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "25% · medium confidence", "key": "metric:25-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "26.7% · medium confidence", "key": "metric:26.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "42% · medium confidence", "key": "metric:42-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "500% · medium confidence", "key": "metric:500-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8% · medium confidence", "key": "metric:8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "88% · medium confidence", "key": "metric:88-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Vidar", "key": "malware-or-tool:vidar" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Fortinet", "key": "publisher:fortinet" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "fortinet.com", "key": "publisher-domain:fortinet.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Artificial Intelligence", "key": "sector:artificial-intelligence" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:arxiv.org:e41b8a2c1c7799de", "title": "Kingma and Ba — Adam: A Method for Stochastic Optimization", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1412.6980", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:blog.knowbe4.com:d1ca4c725a5dcde3", "title": "KnowBe4 summary of Wall Street Journal reporting, AI Used For Social Engineering. Fraudsters Mimic CEO’s Voice in Unusual Cybercrime Case", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.knowbe4.com/ai-used-for-social-engineering.-fraudsters-mimic-ceos-voice-in-unusual-cybercrime-case-wsj", "publisher": "BLOG Knowbe4", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.knowbe4.com", "key": "publisher-domain:blog.knowbe4.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:assets.kpmg.com:e75acc1c045fc9b8", "title": "KPMG — CTI Report MuddyWater PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://assets.kpmg.com/content/dam/kpmgsites/in/pdf/2022/07/KPMG_CTI_Report_muddy.pdf.coredownload.inline.pdf", "publisher": "Assets KPMG", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "assets.kpmg.com", "key": "publisher-domain:assets.kpmg.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:proceedings.neurips.cc:fff20e7d05543a5b", "title": "Krizhevsky, Sutskever, and Hinton: ImageNet Classification with Deep Convolutional Neural Networks", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://proceedings.neurips.cc/paper/2012/hash/c399862d3b9d6b76c8436e924a68c45b-Abstract.html", "publisher": "Proceedings Neurips", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "proceedings.neurips.cc", "key": "publisher-domain:proceedings.neurips.cc" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:kroll.com:022c199193f77808", "title": "kroll.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.kroll.com/en/reports/cyber/threat-intelligence-reports", "publisher": "Kroll", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kroll.com", "key": "publisher-domain:kroll.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:kubernetes.io:22e2c0852624027c", "title": "Kubernetes audit", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/tasks/debug-application-cluster/audit", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:kubernetes.io:142f7ed4da180146", "title": "Kubernetes auditing", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://kubernetes.io/docs/tasks/debug/debug-cluster/audit", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:kubernetes.io:0db2fe9d34c64505", "title": "Kubernetes Events", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/reference/kubernetes-api/cluster-resources/event-v1", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:kubernetes.io:98a5e3693dbeb2c1", "title": "Kubernetes logging architecture", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/concepts/cluster-administration/logging", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:kubernetes.io:155879f03e5104cf", "title": "Kubernetes Namespaces", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:kubernetes.io:0ca70d12237bdfb6", "title": "Kubernetes RBAC", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://kubernetes.io/docs/reference/access-authn-authz/rbac", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" }, { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:kubernetes.io:9c3e7957b8faa803", "title": "Kubernetes Security Checklist", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://kubernetes.io/docs/concepts/security/security-checklist", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:kubernetes.io:ae9eb826f4970c44", "title": "Kubernetes Security documentation", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://kubernetes.io/docs/concepts/security", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Building a Vulnerable Kubernetes Lab: A Complete Guide to 25 Critical Security Issues", "url": "https://1200km.com/articles/read/2026/2026-02-02-building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91/", "type": "article", "domain": "cloud-security" }, { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:huggingface.co:14d4597f88e2bd77", "title": "KV cache strategies", "description": "External source cited by 1 maintained 1200km page.", "url": "https://huggingface.co/docs/transformers/v5.15.1/kv_cache", "publisher": "Huggingface", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "huggingface.co", "key": "publisher-domain:huggingface.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:learn.microsoft.com:ffc6bdb486baff62", "title": "learn.microsoft.com/azure/azure-monitor/reference/tables/microsoftgraphactivitylogs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/microsoftgraphactivitylogs", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:learn.microsoft.com:d65289cb8a9f8c03", "title": "learn.microsoft.com/azure/azure-monitor/reference/tables/signinlogs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:learn.microsoft.com:54cb7022ab8f7110", "title": "learn.microsoft.com/defender-xdr/advanced-hunting-deviceimageloadevents-table", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceimageloadevents-table", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:leftoverlocals.com:32637ebc6879f76b", "title": "LeftoverLocals technical site", "description": "External source cited by 1 maintained 1200km page.", "url": "https://leftoverlocals.com", "publisher": "Leftoverlocals", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "leftoverlocals.com", "key": "publisher-domain:leftoverlocals.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:arxiv.org:02ad74cdb0c9081f", "title": "Lewis et al. — Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://arxiv.org/abs/2005.11401", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "AI, Machine Learning & LLM Foundations", "url": "https://1200km.com/ai-security-course/module-00.html", "type": "research", "domain": "ai-security" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:lief.re:05576023d1c98991", "title": "LIEF PE format documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://lief.re/doc/latest/formats/pe", "publisher": "LIEF", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "lief.re", "key": "publisher-domain:lief.re" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:docs.kernel.org:eb3856d4bf146e31", "title": "Linux kernel self-protection", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.kernel.org/security/self-protection.html", "publisher": "DOCS Kernel", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.kernel.org", "key": "publisher-domain:docs.kernel.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:arxiv.org:74e78e31fd890577", "title": "Liu, Dolan-Gavitt, and Garg — Fine-Pruning", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1805.12185", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:huggingface.co:14ab71e4bda8d541", "title": "LLM Course", "description": "External source cited by 1 maintained 1200km page.", "url": "https://huggingface.co/learn/llm-course/en/chapter2/1", "publisher": "Huggingface", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "huggingface.co", "key": "publisher-domain:huggingface.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI, Machine Learning & LLM Foundations", "url": "https://1200km.com/ai-security-course/module-00.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:developers.google.com:02fce8fbd802d885", "title": "LLM fundamentals", "description": "External source cited by 1 maintained 1200km page.", "url": "https://developers.google.com/machine-learning/crash-course/llm/transformers", "publisher": "Developers Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "developers.google.com", "key": "publisher-domain:developers.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI, Machine Learning & LLM Foundations", "url": "https://1200km.com/ai-security-course/module-00.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:sysdig.com:f846097d9871a728", "title": "LLMjacking: Stolen Cloud Credentials Used in New AI Attack | Sysdig TRT", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack", "publisher": "Sysdig", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sysdig.com", "key": "publisher-domain:sysdig.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:llvm.org:cab2eb027846158f", "title": "LLVM libFuzzer", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://llvm.org/docs/LibFuzzer.html", "publisher": "LLVM", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "llvm.org", "key": "publisher-domain:llvm.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:docs.aws.amazon.com:f9c0c0a5cb108fac", "title": "Log group-level subscription filters — Amazon CloudWatch Logs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Sending EKS Control Plane Logs via AWS Lambda", "url": "https://1200km.com/articles/read/2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:kaspersky.com:fb1d132b4e00d60c", "title": "LogoFAIL", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.kaspersky.com/blog/logofail-uefi-vulnerabilities/50160", "publisher": "Kaspersky", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kaspersky.com", "key": "publisher-domain:kaspersky.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:loldrivers.io:349a8735dca845a0", "title": "loldrivers.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.loldrivers.io", "publisher": "Loldrivers", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "loldrivers.io", "key": "publisher-domain:loldrivers.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:lrqa.com:dc75979304549eab", "title": "lrqa.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.lrqa.com/en/insights/articles/7-cyber-security-best-practices-for-employees", "publisher": "LRQA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "lrqa.com", "key": "publisher-domain:lrqa.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:raw.githubusercontent.com:a1bdba36c5e7e638", "title": "m365/message-trace-m.cohen.csv", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/m365/message-trace-m.cohen.csv", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:raw.githubusercontent.com:5e3ab839a42f2017", "title": "m365/message-trace-p.levi.csv", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/m365/message-trace-p.levi.csv", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:developers.google.com:45d1a15741283141", "title": "Machine Learning Glossary", "description": "External source cited by 1 maintained 1200km page.", "url": "https://developers.google.com/machine-learning/glossary", "publisher": "Developers Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "developers.google.com", "key": "publisher-domain:developers.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI, Machine Learning & LLM Foundations", "url": "https://1200km.com/ai-security-course/module-00.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:arxiv.org:edaf304a7020ce8d", "title": "Madry et al. — Towards Deep Learning Models Resistant to Adversarial Attacks", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1706.06083", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:magnetforensics.com:0bd9dec3dde04e59", "title": "magnetforensics.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.magnetforensics.com/blog/investigating-data-exfiltration-key-digital-artifacts-across-windows-linux-and-macos", "publisher": "Magnetforensics", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "magnetforensics.com", "key": "publisher-domain:magnetforensics.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "Endpoint Threat Hunting: Proactive Detection on Windows, Linux, and macOS", "url": "https://1200km.com/articles/read/2025/2025-12-14-endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:medium.com:befa91c874e0ce83", "title": "Main course article on Medium ↗", "description": "External source cited by 8 maintained 1200km pages.", "url": "https://medium.com/@1200km/im-building-an-ai-security-engineering-course-55e29e6c035e", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" }, { "title": "I’m Building an AI Security Engineering Course", "url": "https://1200km.com/articles/read/2026/2026-07-31-i-m-building-an-ai-security-engineering-course-55e29e6c035e/", "type": "article", "domain": "ai-security" } ] }, { "id": "ai-attack-reference:pub-115", "title": "Malla: Demystifying Real-world Large Language Model Integrated Malicious Services | USENIX", "description": "USENIX academic or empirical research covering Large language model. Indexed with Education context.", "url": "https://www.usenix.org/conference/usenixsecurity24/presentation/lin-zilong", "publisher": "USENIX", "published_at": null, "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Unknown", "key": "publication-date-method:unknown" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Unknown", "key": "publication-date-precision:unknown" }, { "facet": "Publisher", "type": "publisher", "value": "USENIX", "key": "publisher:usenix" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "usenix.org", "key": "publisher-domain:usenix.org" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "ai-cyber research or controlled study", "key": "relevance-basis:ai-cyber-research-or-controlled-study" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Hospitality", "key": "sector:hospitality" }, { "facet": "Source type", "type": "source_type", "value": "academic or empirical research", "key": "source-type:academic-or-empirical-research" }, { "facet": "Statistical use", "type": "statistical_use", "value": "possible_denominator", "key": "statistical-use:possible-denominator" }, { "facet": "Year", "type": "year", "value": "Unknown", "key": "year:unknown" } ], "used_in": [] }, { "id": "site-reference:maltego.com:a54d37c5ed8d4187", "title": "Maltego", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.maltego.com", "publisher": "Maltego", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "maltego.com", "key": "publisher-domain:maltego.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:e7cc10e2d5b63541", "title": "Malware Behavior Catalog", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/MBCProject/mbc-markdown", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:malwarebytes.com:820d181c5b9b91c3", "title": "malwarebytes.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.malwarebytes.com/blog/business/2022/04/denonia-cryptominer-is-first-malware-to-target-aws-lambda", "publisher": "Malwarebytes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "malwarebytes.com", "key": "publisher-domain:malwarebytes.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:man7.org:a02b92ea4ef19f2a", "title": "man7.org/linux/man-pages/man2/ptrace.2.html", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.man7.org/linux/man-pages/man2/ptrace.2.html", "publisher": "MAN7", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "man7.org", "key": "publisher-domain:man7.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cloud.google.com:0623f652a44d42bb", "title": "Mandiant / Google Cloud: UNC5537 Snowflake data theft", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:4b64cb8207029195", "title": "Mandiant capa", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/mandiant/capa", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:633353c7336f3e58", "title": "Mandiant FLARE-VM repository and current installation requirements", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://github.com/mandiant/flare-vm", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "How to Build a Safe Malware Analysis Lab with FLARE-VM, REMnux, and INetSim", "url": "https://1200km.com/articles/read/2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602/", "type": "article", "domain": "malware-analysis" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:services.google.com:14b1024fbc72d871", "title": "Mandiant M-Trends 2025", "description": "External source cited by 1 maintained 1200km page.", "url": "https://services.google.com/fh/files/misc/m-trends-2025-en.pdf", "publisher": "Services Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "services.google.com", "key": "publisher-domain:services.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:mandiant.com:ebf1d2bed553a72e", "title": "Mandiant, APT1 report", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf", "publisher": "Mandiant", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mandiant.com", "key": "publisher-domain:mandiant.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:fae0f32549deec81", "title": "Mandiant, Chinese cyber espionage tactics / UNC3886", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/chinese-espionage-tactics", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:mandiant.com:25ae8b8476b229f5", "title": "Mandiant, HAMMERTOSS", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.mandiant.com/sites/default/files/2021-09/rpt-apt29-hammertoss-1-1.pdf", "publisher": "Mandiant", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mandiant.com", "key": "publisher-domain:mandiant.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:216aa1da4839f1b6", "title": "Mandiant, UNC3886 Exploiting CVE-2023–34048 Since Late 2021", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/chinese-vmware-exploitation-since-2021", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cloud.google.com:d9edb691daa2a2fb", "title": "Mandiant, WannaCry malware profile", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/wannacry-malware-profile", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloud.google.com:69a989c46421dcba", "title": "Mandiant, WannaCry use of EternalBlue", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/smb-exploited-wannacry-use-of-eternalblue", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:mandiant.com:e8cc5ad0d1dd436c", "title": "mandiant.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise", "publisher": "Mandiant", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mandiant.com", "key": "publisher-domain:mandiant.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:mandiant.com:0af8c5f266bec26c", "title": "mandiant.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor", "publisher": "Mandiant", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mandiant.com", "key": "publisher-domain:mandiant.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-054", "title": "Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator", "description": "Anthropic provider or government report covering Autonomous or agentic intrusion, Malware development, and Obfuscation and evasion. Indexed with Critical Infrastructure and Anthropic context.", "url": "https://www.anthropic.com/research/attack-navigator", "publisher": "Anthropic", "published_at": "2026-06-03", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Autonomous or agentic intrusion", "key": "ai-use-case:autonomous-or-agentic-intrusion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "832 accounts · medium confidence", "key": "metric:832-accounts-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "11 months · medium confidence", "key": "metric:11-months-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "12 months · medium confidence", "key": "metric:12-months-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "0.7% · medium confidence", "key": "metric:0.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12% · medium confidence", "key": "metric:12-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.4% · medium confidence", "key": "metric:2.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.8% · medium confidence", "key": "metric:2.8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "22.5% · medium confidence", "key": "metric:22.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "30.3% · medium confidence", "key": "metric:30.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "33.5% · medium confidence", "key": "metric:33.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "33% · medium confidence", "key": "metric:33-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "54.8% · medium confidence", "key": "metric:54.8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "54.9% · medium confidence", "key": "metric:54.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "55.9% · medium confidence", "key": "metric:55.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "56.1% · medium confidence", "key": "metric:56.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "56% · medium confidence", "key": "metric:56-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.2% · medium confidence", "key": "metric:6.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.5% · medium confidence", "key": "metric:6.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "64.7% · medium confidence", "key": "metric:64.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "69% · medium confidence", "key": "metric:69-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8.6% · medium confidence", "key": "metric:8.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8.7% · medium confidence", "key": "metric:8.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8.9% · medium confidence", "key": "metric:8.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "80% · medium confidence", "key": "metric:80-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "84.4% · medium confidence", "key": "metric:84.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "99% · medium confidence", "key": "metric:99-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1003", "key": "mitre-attack-id:t1003" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1005", "key": "mitre-attack-id:t1005" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1020", "key": "mitre-attack-id:t1020" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1021", "key": "mitre-attack-id:t1021" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1021.004", "key": "mitre-attack-id:t1021.004" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1027", "key": "mitre-attack-id:t1027" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1055", "key": "mitre-attack-id:t1055" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1078.003", "key": "mitre-attack-id:t1078.003" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1087", "key": "mitre-attack-id:t1087" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1210", "key": "mitre-attack-id:t1210" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1505.003", "key": "mitre-attack-id:t1505.003" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1560", "key": "mitre-attack-id:t1560" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1562", "key": "mitre-attack-id:t1562" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1566", "key": "mitre-attack-id:t1566" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1587", "key": "mitre-attack-id:t1587" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1587.001", "key": "mitre-attack-id:t1587.001" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Anthropic", "key": "publisher:anthropic" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "anthropic.com", "key": "publisher-domain:anthropic.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:github.com:35069229a591c802", "title": "MCP trust model", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://github.com/modelcontextprotocol/modelcontextprotocol/security", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:6fe49f2453ce3a30", "title": "Medium — Course Review: TrainSec Malware Analyst Professional — Level 1", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/course-review-trainsec-malware-analyst-professional-level-1-203ca89b76a2", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Course Review — TrainSec Malware Analyst Professional — Level 1", "url": "https://1200km.com/articles/read/2026/2026-08-19-course-review-trainsec-malware-analyst-professional-level-1-203ca89b76a2/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:90b78682355e28b3", "title": "Medium publication", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/assembly-for-malware-analysis-be0679241940", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:448db7f6b106fa9f", "title": "Medium publication", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/pe-file-structure-for-malware-analysis-d93acb97d9f3", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:2ac4a25e5a6a301b", "title": "Medium publication", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/strings-analysis-for-malware-analysis-turning-391815ee35e2", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Strings Analysis for Malware Analysis: Turning Binary Text into Defensible Hypotheses", "url": "https://1200km.com/articles/read/2026/2026-08-12-strings-analysis-for-malware-analysis-turning-391815ee35e2/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:medium.com:e662a7c23b503e37", "title": "Medium snapshot (114/106) ↗", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-in-cyberattacks-a-statistical-cti-study-of-114-publications-b8416d856b94", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "site-reference:medium.com:9200784eda782dc2", "title": "medium.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@josegpach/exploiting-ftp-vulnerabilities-on-metasploitable-2-bbd935d42e23", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Enhancing Penetration Testing with HackerAI: Step-by-Step Guide (Metasploitable Lab)", "url": "https://1200km.com/articles/read/2025/2025-11-26-enhancing-penetration-testing-with-hackerai-step-by-step-guide-metasploitable-lab-b2ab2cdd4139/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:ee5f75c5b13a4500", "title": "medium.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@Sahan0710/litter-sherlocks-hack-the-box-dnscat-decoding-wireshark-dns-data-exfiltration-and-dns-tunneling-ac372663c98b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "Protocol-Level Network Threat Hunting: A Wireshark-Centric Guide", "url": "https://1200km.com/articles/read/2025/2025-12-12-protocol-level-network-threat-hunting-a-wireshark-centric-guide-a6770ffc96c6/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:medium.com:a96536cfac660292", "title": "medium.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@yamini.holla/chronicle-siem-introduction-single-event-rules-aaa32b06f991", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:rapid7.com:ee70547b1285dfb1", "title": "Metasploit Framework", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.rapid7.com/products/metasploit", "publisher": "Rapid7", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "rapid7.com", "key": "publisher-domain:rapid7.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:microsoft.com:73f97eee3ac12c26", "title": "Microsoft — Exposing POLONIUM activity and infrastructure targeting Israeli organizations", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:microsoft.com:46e7b3f60d33b0d4", "title": "Microsoft — MERCURY and DEV-1084: Destructive attack on hybrid environment", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" }, { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:microsoft.com:9128cf6a3fdf76a1", "title": "Microsoft — Mint Sandstorm", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/security-insider/mint-sandstorm", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:microsoft.com:ce29e719f9808cc0", "title": "Microsoft — Peach Sandstorm deploys new custom Tickler malware", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2024/08/28/peach-sandstorm-deploys-new-custom-tickler-malware-in-long-running-intelligence-gathering-operations", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:learn.microsoft.com:ce6a2fa25582952e", "title": "Microsoft Authenticode documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/install/authenticode", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:microsoft.com:367a9ed2795ac912", "title": "Microsoft BlackLotus / CVE-2022–21894 guidance", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:learn.microsoft.com:af72571fd15f606e", "title": "Microsoft Cloud Security Benchmark: Incident Response", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-incident-response", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:learn.microsoft.com:4c4262ea10536218", "title": "Microsoft CreateRemoteThread documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:88dd2576e18e6885", "title": "Microsoft Defender for Identity alerts reference", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/defender-for-identity/alerts-overview", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "ITDR Professional Roadmap", "url": "https://1200km.com/ITDR/docs/roadmap/", "type": "documentation", "domain": "identity-security" } ] }, { "id": "site-reference:microsoft.com:eba8991f256e1912", "title": "Microsoft Digital Defense Report 2024", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/business/security-insider/reports/digital-defense-report", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:learn.microsoft.com:0f780f54be728573", "title": "Microsoft documents process creation event 4688", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Validate a command-shell detection candidate with benign events", "url": "https://1200km.com/learning-paths/command-shell-validation/", "type": "research", "domain": "detection-engineering" } ] }, { "id": "site-reference:learn.microsoft.com:043944f4cdec9c89", "title": "Microsoft exploit protection reference", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://learn.microsoft.com/en-us/defender-endpoint/exploit-protection-reference", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:learn.microsoft.com:a92dd1a8a827f071", "title": "Microsoft GetProcAddress documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getprocaddress", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:ac613b89f8ef175a", "title": "Microsoft IMAGE_DOS_HEADER structure", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_dos_header", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:e812fcc785e2e82d", "title": "Microsoft IMAGE_FILE_HEADER structure", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_file_header", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:02772e40f2284a77", "title": "Microsoft IMAGE_OPTIONAL_HEADER32 structure", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header32", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:25024ea04ecce9d4", "title": "Microsoft IMAGE_OPTIONAL_HEADER64 structure", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header64", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:d9586e6042a37273", "title": "Microsoft IMAGE_SECTION_HEADER structure", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_section_header", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:18820e54f4021af8", "title": "Microsoft ImageHlp image functions", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/debug/imagehlp-functions", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:c1355094291d925d", "title": "Microsoft Learn — How Microsoft names threat actors", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-threat-actor-naming?view=o365-worldwide", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:msrc.microsoft.com:ee3214c396b6fa56", "title": "Microsoft MSRC: CVE-2025-32711", "description": "External source cited by 5 maintained 1200km pages.", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711", "publisher": "MSRC Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "msrc.microsoft.com", "key": "publisher-domain:msrc.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:learn.microsoft.com:f84c4f4054589c85", "title": "Microsoft PE format specification", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://learn.microsoft.com/en-us/windows/win32/debug/pe-format", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" }, { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:techcommunity.microsoft.com:0f146b4863d47ef1", "title": "Microsoft Secure Boot “Act now” 2026 guidance", "description": "External source cited by 1 maintained 1200km page.", "url": "https://techcommunity.microsoft.com/blog/windows-itpro-blog/act-now-secure-boot-certificates-expire-in-june-2026/4426856", "publisher": "Techcommunity Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "techcommunity.microsoft.com", "key": "publisher-domain:techcommunity.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:support.microsoft.com:966a44f4069e9995", "title": "Microsoft Secure Boot certificate expiration guidance", "description": "External source cited by 1 maintained 1200km page.", "url": "https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e", "publisher": "Support Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "support.microsoft.com", "key": "publisher-domain:support.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:microsoft.com:aa06062dae88d39f", "title": "Microsoft Security Blog, AI as tradecraft: How threat actors operationalize AI", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:microsoft.com:41ccbdd48f4a8ff0", "title": "Microsoft Security Blog, AI-enabled device code phishing campaign", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:microsoft.com:f39af18aa274f944", "title": "Microsoft Security Blog, How Microsoft discovers and mitigates evolving attacks against AI guardrails", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2024/04/11/how-microsoft-discovers-and-mitigates-evolving-attacks-against-ai-guardrails", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:microsoft.com:06214cdec6cd8847", "title": "Microsoft Security Blog: identity and Midnight Blizzard guidance", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" } ] }, { "id": "site-reference:microsoft.com:824289cb3e33f287", "title": "Microsoft Security, SesameOp: Novel backdoor uses OpenAI Assistants API for command and control (November 3, 2025)", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" }, { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:learn.microsoft.com:e67a202ae54fcec0", "title": "Microsoft SignTool documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:b85c6875a5a8f316", "title": "Microsoft Sysmon", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:72c6d9dc85edd119", "title": "Microsoft TEB structure", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:6b1b049c80da1edd", "title": "Microsoft VirtualAlloc documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualalloc", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:a99ce7952e1e9fff", "title": "Microsoft x64 ABI conventions", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/cpp/build/x64-software-conventions?view=msvc-170", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:084eb81e00c57c64", "title": "Microsoft x64 calling convention", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/cpp/build/x64-calling-convention?view=msvc-170", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:microsoft.com:ea4265e77bbb3883", "title": "Microsoft, GoldMax, GoldFinder, and Sibot", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.microsoft.com/en-us/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:blogs.microsoft.com:0ebb744318e58e6d", "title": "Microsoft, Iran accelerates cyber operations against Israel", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blogs.microsoft.com/on-the-issues/2024/02/06/iran-accelerates-cyber-ops-against-israel", "publisher": "Blogs Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blogs.microsoft.com", "key": "publisher-domain:blogs.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:microsoft.com:ee8c6276d39df70a", "title": "Microsoft, NotPetya technical analysis", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.microsoft.com/security/blog/2017/10/03/advanced-threat-analytics-security-research-network-technical-analysis-notpetya", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:microsoft.com:aad8bd1951f44c2a", "title": "Microsoft’s Volt Typhoon advisory (May 2023).", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "Manual CTI vs. AI-Assisted CTI: A Step-by-Step Clock Comparison", "url": "https://1200km.com/articles/read/2026/2026-05-08-manual-cti-vs-ai-assisted-cti-a-step-by-step-clock-comparison-ee08325203fc/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:microsoft.com:a34275efc2c95152", "title": "Midnight Blizzard responder guidance", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" }, { "title": "Malicious Activity as a Statistical Signal: A Detection Engineering Analysis of Anomaly-Based…", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "type": "article", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:misp-project.org:575505161811fb73", "title": "MISP — self-hosted", "description": "External source cited by 6 maintained 1200km pages.", "url": "https://www.misp-project.org", "publisher": "MISP Project", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "misp-project.org", "key": "publisher-domain:misp-project.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "AdversaryGraph vs MISP", "url": "https://1200km.com/adversarygraph-docs/comparisons/misp/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Comparison Overview", "url": "https://1200km.com/adversarygraph-docs/comparisons/overview/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:mithrilsecurity.io:a3cdcd35297d3b89", "title": "Mithril Security — PoisonGPT demonstration", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.mithrilsecurity.io/blog/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news", "publisher": "Mithrilsecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mithrilsecurity.io", "key": "publisher-domain:mithrilsecurity.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:blog.mithrilsecurity.io:fa205733cd8fddbb", "title": "Mithril Security — PoisonGPT demonstration (research case, not a confirmed campaign)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news", "publisher": "BLOG Mithrilsecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.mithrilsecurity.io", "key": "publisher-domain:blog.mithrilsecurity.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:attack.mitre.org:7232c3f6d266e4cd", "title": "MITRE adversary-emulation plans", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/resources/adversary-emulation-plans", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:atlas.mitre.org:147bc5a499cae481", "title": "MITRE ATLAS — Adversarial Threat Landscape for Artificial-Intelligence Systems", "description": "External source cited by 14 maintained 1200km pages.", "url": "https://atlas.mitre.org", "publisher": "Atlas Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "atlas.mitre.org", "key": "publisher-domain:atlas.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" }, { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" }, { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Engineering", "url": "https://1200km.com/ai-security-course.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" }, { "title": "Threat Matrix", "url": "https://1200km.com/adversarygraph-web-guide.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:9f5648e7fd45b899", "title": "MITRE ATLAS dataset — AML.T0020 Poison Training Data", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/mitre-atlas/atlas-data/blob/main/dist/ATLAS.yaml", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:attack.mitre.org:e96f8e578dbd906d", "title": "MITRE ATT&CK — Agrius", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/groups/G1030", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:attack.mitre.org:60c08f71f0daa066", "title": "MITRE ATT&CK — APT34", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/groups/G0049", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:attack.mitre.org:2eecb5256cccfd82", "title": "MITRE ATT&CK — APT35 / Charming Kitten", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/groups/G0059", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:attack.mitre.org:03689cb0dacc1d82", "title": "MITRE ATT&CK — MuddyWater G0069", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/groups/G0069", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" }, { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:attack.mitre.org:df6fbce5de5eec83", "title": "MITRE ATT&CK — POWERSTATS S0223", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/software/S0223", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:attack.mitre.org:64024f580c85a776", "title": "MITRE ATT&CK — PowGoop S1046", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/software/S1046", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:attack.mitre.org:1a7278d5b7b38be3", "title": "MITRE ATT&CK — Reconnaissance tactic", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/tactics/TA0043", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:attack.mitre.org:69be684472f5feef", "title": "MITRE ATT&CK Cloud Matrix", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/matrices/enterprise/cloud", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:attack.mitre.org:1c52896940592a93", "title": "MITRE ATT&CK CTI", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/resources/training/cti", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Engineering", "url": "https://1200km.com/ai-security-course.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:attack.mitre.org:b42f2f4cac455dae", "title": "MITRE ATT&CK KV Botnet campaign C0035", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/campaigns/C0035", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:attack.mitre.org:855ef7f6e5440c33", "title": "MITRE ATT&CK RedPenguin (Campaign C0056, attributed to UNC3886)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/campaigns/C0056", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:attack.mitre.org:8436ae38531d9079", "title": "MITRE ATT&CK Software", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/software", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:attack.mitre.org:e78fae4c406e9847", "title": "MITRE ATT&CK UNC3886 (Group G1048)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/groups/G1048", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:attack.mitre.org:cd83e11390b33c91", "title": "MITRE ATT&CK, C0028", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/campaigns/C0028", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:attack.mitre.org:c54e51ab92a4430c", "title": "MITRE ATT&CK, Enterprise Matrix", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://attack.mitre.org/matrices/enterprise", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" }, { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:attack.mitre.org:288e00c1f9c6d5ad", "title": "MITRE ATT&CK, ICS Matrix", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/matrices/ics", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:attack.mitre.org:9e3777e3e86c52dc", "title": "MITRE ATT&CK, Mobile Matrix", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://attack.mitre.org/matrices/mobile", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "type": "article", "domain": "malware-analysis" }, { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:cwe.mitre.org:37aeb8370f8c1702", "title": "MITRE CWE", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cwe.mitre.org/index.html", "publisher": "CWE Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cwe.mitre.org", "key": "publisher-domain:cwe.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:d3fend.mitre.org:a7da08a972c3ff24", "title": "MITRE D3FEND", "description": "External source cited by 5 maintained 1200km pages.", "url": "https://d3fend.mitre.org", "publisher": "D3fend Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "d3fend.mitre.org", "key": "publisher-domain:d3fend.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cwe.mitre.org:43506c2f5bd6e3b3", "title": "MITRE vulnerability theory", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://cwe.mitre.org/documents/vulnerability_theory/intro.html", "publisher": "CWE Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cwe.mitre.org", "key": "publisher-domain:cwe.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:mitre-attack.github.io:efaac0163d5a2a57", "title": "mitre-attack.github.io/attack-navigator", "description": "External source cited by 5 maintained 1200km pages.", "url": "https://mitre-attack.github.io/attack-navigator", "publisher": "Mitre Attack Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mitre-attack.github.io", "key": "publisher-domain:mitre-attack.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" }, { "title": "Import & Export", "url": "https://1200km.com/adversarygraph-docs/navigator/import-export/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:mitre.org:ff3ad7d195ae5c37", "title": "MITRE, ATT&CK overview", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.mitre.org/focus-areas/cybersecurity/mitre-attack", "publisher": "Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mitre.org", "key": "publisher-domain:mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:attack.mitre.org:8a5cbd55dca129d8", "title": "MITRE: DET0202", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/detectionstrategies/DET0202", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Validate a command-shell detection candidate with benign events", "url": "https://1200km.com/learning-paths/command-shell-validation/", "type": "research", "domain": "detection-engineering" } ] }, { "id": "site-reference:attack.mitre.org:e41a8bdb6a4dd916", "title": "MITRE: Windows Command Shell", "description": "External source cited by 1 maintained 1200km page.", "url": "https://attack.mitre.org/techniques/T1059/003", "publisher": "Attack Mitre", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "attack.mitre.org", "key": "publisher-domain:attack.mitre.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Validate a command-shell detection candidate with benign events", "url": "https://1200km.com/learning-paths/command-shell-validation/", "type": "research", "domain": "detection-engineering" } ] }, { "id": "site-reference:mitre.ptsecurity.com:9416f56062e24e85", "title": "mitre.ptsecurity.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://mitre.ptsecurity.com/en-US/T1040", "publisher": "Mitre Ptsecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mitre.ptsecurity.com", "key": "publisher-domain:mitre.ptsecurity.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:docs.cloud.google.com:9b9a56940b39ad0d", "title": "ML.VALIDATE_DATA_SKEW function", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-validate-data-skew", "publisher": "DOCS Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.cloud.google.com", "key": "publisher-domain:docs.cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:mobsf.github.io:4b9d6f67d82c7cb4", "title": "mobsf.github.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://mobsf.github.io/docs", "publisher": "Mobsf Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mobsf.github.io", "key": "publisher-domain:mobsf.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:learn.microsoft.com:d5a66cec99bbf4dd", "title": "Monitor Azure Kubernetes Service with Azure Monitor | Microsoft Learn", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/azure/aks/monitor-aks", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:docs.metasploit.com:87de39f9163467d7", "title": "More information about msfdb in official docs here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.metasploit.com/docs/using-metasploit/intermediate/metasploit-database-support.html", "publisher": "DOCS Metasploit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.metasploit.com", "key": "publisher-domain:docs.metasploit.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Ultimate Guide to Metasploit. Part 1.", "url": "https://1200km.com/articles/read/2024/2024-11-17-the-ultimate-guide-to-metasploit-part-1-43c8573487df/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:majorgeeks.com:e6f329ace9b1478e", "title": "More information and download this tool here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.majorgeeks.com/files/details/detect_it_easy.html", "publisher": "Majorgeeks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "majorgeeks.com", "key": "publisher-domain:majorgeeks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:arxiv.org:e8cc7f5045bc662c", "title": "More than you've asked for: A Comprehensive Analysis of Novel Prompt Injection Threats to Application-Integrated Large Language Models", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://arxiv.org/abs/2302.12173", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "type": "article", "domain": "offensive-research" }, { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:docs.getmoto.org:a0823f943ec8fd4a", "title": "moto", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.getmoto.org", "publisher": "DOCS Getmoto", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.getmoto.org", "key": "publisher-domain:docs.getmoto.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "StratusAI: I Built an AI-Powered Cloud Security Scanner for AWS and GCP — Here’s Everything", "url": "https://1200km.com/articles/read/2026/2026-03-14-stratusai-i-built-an-ai-powered-cloud-security-scanner-for-aws-and-gcp-here-s-everything-89c6702d3b84/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:microsoft.com:80593cde286fb023", "title": "multi-stage AiTM phishing and BEC report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:usatoday.com:fbffe9dd5a7c7e84", "title": "MySpace breach reportedly affects 360 million records", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.usatoday.com/story/tech/2016/05/31/360-million-myspace-accounts-breached/85183200", "publisher": "Usatoday", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "usatoday.com", "key": "publisher-domain:usatoday.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:archives.gov:8b28c0a96a30ce38", "title": "National Archives, Aerial Photograph of Missiles in Cuba", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.archives.gov/milestone-documents/aerial-photograph-of-missiles-in-cuba", "publisher": "Archives", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "archives.gov", "key": "publisher-domain:archives.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:nvd.nist.gov:aa33443c1c77155b", "title": "National Vulnerability Database", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://nvd.nist.gov", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" }, { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" }, { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:coi.nato.int:cb37ae5fea5d0825", "title": "NATO AJP-2, Intelligence, Counter-Intelligence and Security", "description": "External source cited by 1 maintained 1200km page.", "url": "https://coi.nato.int/EWCOI/EW%20COI%20Shared%20Documents/WGs/NEWWG/EW%20Policy%20and%20Doctrine%20Panel%20%28EWPDP%29/AJP%203.6%20-%20EW%20Doctrine/AJP-3.6%20References/20160222_NU_AJP_2%20EdA%20V2_Intelligence%2C%20counter-intelligence%20ans%20security.pdf", "publisher": "COI NATO", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "coi.nato.int", "key": "publisher-domain:coi.nato.int" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:misp-project.org:ea655202f3cc9e4f", "title": "NATO MISP Community", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.misp-project.org/communities", "publisher": "MISP Project", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "misp-project.org", "key": "publisher-domain:misp-project.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:ncsc.gov.uk:7eb78bde20c7d7a9", "title": "NCSC-UK — Joint advisory on MuddyWater actor", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ncsc.gov.uk/news/joint-advisory-observes-muddywater-actors-conducting-cyber-espionage", "publisher": "NCSC GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ncsc.gov.uk", "key": "publisher-domain:ncsc.gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:ncsc.gov.uk:07f418ffa103924f", "title": "ncsc.gov.uk", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ncsc.gov.uk/guidance/dealing-with-the-solarwinds-orion-compromise", "publisher": "NCSC GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ncsc.gov.uk", "key": "publisher-domain:ncsc.gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:ndss-symposium.org:c920f772db47be24", "title": "ndss-symposium.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ndss-symposium.org/wp-content/uploads/2017/09/practical-attacks-against-privacy-availability-4g-lte-mobile-communication-systems.pdf", "publisher": "NDSS Symposium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ndss-symposium.org", "key": "publisher-domain:ndss-symposium.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:elastic.co:68e9e1d4ad085a75", "title": "nested field type", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.elastic.co/guide/en/elasticsearch/reference/current/nested.html", "publisher": "Elastic", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "elastic.co", "key": "publisher-domain:elastic.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:nhimg.org:c688ba506be22346", "title": "nhimg.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nhimg.org/codecov-breach", "publisher": "Nhimg", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nhimg.org", "key": "publisher-domain:nhimg.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:csrc.nist.gov:0355e423b2f0ba07", "title": "NIST AI 100-2 E2025 — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations", "description": "External source cited by 6 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/ai/100/2/e2025/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:doi.org:8cadee7aa0e59116", "title": "NIST AI 100-3 — The Language of Trustworthy AI", "description": "External source cited by 5 maintained 1200km pages.", "url": "https://doi.org/10.6028/NIST.AI.100-3", "publisher": "DOI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "doi.org", "key": "publisher-domain:doi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "type": "article", "domain": "ai-security" }, { "title": "AI, Machine Learning & LLM Foundations", "url": "https://1200km.com/ai-security-course/module-00.html", "type": "research", "domain": "ai-security" }, { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:nist.gov:bfba4cd5131daa71", "title": "NIST AI 600-1 GenAI Profile", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "publisher": "NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nist.gov", "key": "publisher-domain:nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:airc.nist.gov:e01641ab3e61ba4a", "title": "NIST AI Resource Center", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://airc.nist.gov", "publisher": "AIRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "airc.nist.gov", "key": "publisher-domain:airc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:nist.gov:54dbc15413425997", "title": "NIST AI Risk Management Framework", "description": "External source cited by 7 maintained 1200km pages.", "url": "https://www.nist.gov/itl/ai-risk-management-framework", "publisher": "NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nist.gov", "key": "publisher-domain:nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "AI Security Engineering", "url": "https://1200km.com/ai-security-course.html", "type": "guide", "domain": "ai-security" }, { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:nist.gov:c6a9ca02e11b0049", "title": "NIST CSF 2.0", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20", "publisher": "NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nist.gov", "key": "publisher-domain:nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:nist.gov:209a744648b905db", "title": "NIST Cybersecurity Framework 2.0", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://www.nist.gov/cyberframework", "publisher": "NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nist.gov", "key": "publisher-domain:nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:csrc.nist.gov:317bc5df10d67776", "title": "NIST OSCAL", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/projects/open-security-controls-assessment-language", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:nist.gov:bdb30acd3a80bd65", "title": "NIST Privacy Framework", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.nist.gov/privacy-framework/privacy-framework", "publisher": "NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nist.gov", "key": "publisher-domain:nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:csrc.nist.gov:85083663a60428c3", "title": "NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/115/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:csrc.nist.gov:6b878f0182108708", "title": "NIST SP 800-161 Rev. 1", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:csrc.nist.gov:7b0ca573bc8960a7", "title": "NIST SP 800-190", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/190/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:csrc.nist.gov:ecea8146f24becc5", "title": "NIST SP 800-207", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/207/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:csrc.nist.gov:90809f5a4664a1a3", "title": "NIST SP 800-216 vulnerability disclosure guidelines", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/216/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:csrc.nist.gov:3382974f730f995a", "title": "NIST SP 800-218, SSDF 1.1", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/218/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:csrc.nist.gov:dabdfef9f4016e90", "title": "NIST SP 800-218A", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/218/a/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:csrc.nist.gov:348e75a54352a230", "title": "NIST SP 800-30 Rev. 1", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/30/r1/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:csrc.nist.gov:8dc27262a790e660", "title": "NIST SP 800-37 Rev. 2", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/37/r2/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:csrc.nist.gov:47b5320ad80cbfac", "title": "NIST SP 800-53A Rev. 5", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/53/a/r5/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:csrc.nist.gov:f53ed62dd159700c", "title": "NIST SP 800-61 Revision 3", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/61/r3/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:csrc.nist.gov:a69fd4db3ef5f768", "title": "NIST SP 800-83 Rev. 1", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/83/r1/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:csrc.nist.gov:a525fecba1e01b54", "title": "NIST SP 800-86", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/86/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:nitrd.gov:d53ff4324179b25f", "title": "nitrd.gov", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.nitrd.gov/nitrdgroups/images/7/77/5G-NR-Jamming-Vuk-Marojevic.pdf", "publisher": "Nitrd", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nitrd.gov", "key": "publisher-domain:nitrd.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:nmap.org:f29c52f27c6bc207", "title": "nmap.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nmap.org/download.html", "publisher": "NMAP", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nmap.org", "key": "publisher-domain:nmap.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1", "url": "https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:nozominetworks.com:56d6bff54b1a378f", "title": "Nozomi OT/IoT cybersecurity trends (Feb 2026)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.nozominetworks.com/ot-iot-cybersecurity-trends-insights-february-2026", "publisher": "Nozominetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nozominetworks.com", "key": "publisher-domain:nozominetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:media.defense.gov:4181234042867757", "title": "NSA BlackLotus mitigation guide (PDF)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://media.defense.gov/2023/Jun/22/2003245723/-1/-1/0/CSI_BlackLotus_Mitigation_Guide.PDF", "publisher": "Media Defense", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "media.defense.gov", "key": "publisher-domain:media.defense.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:numberanalytics.com:2313d6b459e4e607", "title": "numberanalytics.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.numberanalytics.com/blog/ultimate-guide-information-security-risk-communication", "publisher": "Numberanalytics", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "numberanalytics.com", "key": "publisher-domain:numberanalytics.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:nvd.nist.gov:f9e6c45f20fab30c", "title": "NVD *Modified After Enrichment vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell…*nvd.nist.gov", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2523", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI-Driven Pentesting at Home: Using HexStrike-AI for Full Network Discovery and Exploitation", "url": "https://1200km.com/articles/read/2025/2025-12-21-ai-driven-pentesting-at-home-using-hexstrike-ai-for-full-network-discovery-and-exploitatio-00a9e88b3bde/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:services.nvd.nist.gov:8e6a586c204b6155", "title": "NVD API — vector retrieval", "description": "External source cited by 1 maintained 1200km page.", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0", "publisher": "Services NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "services.nvd.nist.gov", "key": "publisher-domain:services.nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:nvd.nist.gov:58af8d752c0c65d6", "title": "NVD API key", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/developers/request-an-api-key", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:nvd.nist.gov:92a769a9a245d33c", "title": "NVD Calculator", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:nvd.nist.gov:e042bfc143047ff0", "title": "NVD CVE-2024–54085", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54085", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:nvd.nist.gov:bf2bc3b699792791", "title": "nvd.nist.gov+1", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35028", "publisher": "NVD NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nvd.nist.gov", "key": "publisher-domain:nvd.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike MCP Orchestration with Ollama: Ubuntu Host, Kali VM, SSH Bridging, and Performance…", "url": "https://1200km.com/articles/read/2025/2025-12-31-hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:sentinelone.com:ec00500521772f46", "title": "NVIDIA Jetson Linux/NvGPU bulletins show embedded GPU stacks can contain privilege-escalation and isolation flaws.", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sentinelone.com/vulnerability-database/cve-2024-0126", "publisher": "Sentinelone", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:docs.oasis-open.org:beff90acdfd2b520", "title": "OASIS — STIX 2.1 HTML specification", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html", "publisher": "DOCS Oasis OPEN", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.oasis-open.org", "key": "publisher-domain:docs.oasis-open.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" }, { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:docs.oasis-open.org:c936df01459fb1a7", "title": "OASIS — STIX 2.1 PDF specification", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.oasis-open.org/cti/stix/v2.1/cs02/stix-v2.1-cs02.pdf", "publisher": "DOCS Oasis OPEN", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.oasis-open.org", "key": "publisher-domain:docs.oasis-open.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:ocsf.io:9b49f8a200ed5650", "title": "OCSF", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://ocsf.io", "publisher": "OCSF", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ocsf.io", "key": "publisher-domain:ocsf.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:schema.ocsf.io:8819757a64a6a3b7", "title": "OCSF schema", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://schema.ocsf.io", "publisher": "Schema OCSF", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "schema.ocsf.io", "key": "publisher-domain:schema.ocsf.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" }, { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" } ] }, { "id": "site-reference:dni.gov:d44348385db1ee42", "title": "ODNI, ICD 203", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.dni.gov/files/documents/ICD/ICD-203.pdf", "publisher": "DNI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dni.gov", "key": "publisher-domain:dni.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:dni.gov:d900f312216a6b24", "title": "ODNI, Iran: Nuclear Intentions and Capabilities", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.dni.gov/files/documents/Newsroom/Reports%20and%20Pubs/20071203_release.pdf", "publisher": "DNI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "dni.gov", "key": "publisher-domain:dni.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:ojp.gov:eb5ebec8e3f49c4c", "title": "Office of Justice Programs summary", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ojp.gov/ncjrs/virtual-library/abstracts/911-commission-report-executive-summary", "publisher": "OJP", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ojp.gov", "key": "publisher-domain:ojp.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:history.state.gov:e35c2364558030a4", "title": "Office of the Historian, FRUS chronology", "description": "External source cited by 1 maintained 1200km page.", "url": "https://history.state.gov/historicaldocuments/frus1961-63v11/d16", "publisher": "History State", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "history.state.gov", "key": "publisher-domain:history.state.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:trainsec.net:2ccc5b1a509a8f31", "title": "Official course syllabus", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://trainsec.net/wp-content/uploads/2025/06/Syllabus_-Malware-Analyst-Professional-Level-1.pdf", "publisher": "Trainsec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "trainsec.net", "key": "publisher-domain:trainsec.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Course Review — TrainSec Malware Analyst Professional — Level 1", "url": "https://1200km.com/articles/read/2026/2026-08-19-course-review-trainsec-malware-analyst-professional-level-1-203ca89b76a2/", "type": "article", "domain": "malware-analysis" }, { "title": "TrainSec Malware Analyst Professional Level 1", "url": "https://1200km.com/courses/trainsec-malware-analyst-professional-level-1/", "type": "case-study", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:acc896e315b33ad1", "title": "official data repository", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/mitre-atlas/atlas-data", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:hashcat.net:7fd8401f442f5f70", "title": "official Hashcat website", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://hashcat.net/hashcat", "publisher": "Hashcat", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "hashcat.net", "key": "publisher-domain:hashcat.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Breaking the Code: How to Use Hashcat for Effective Password Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-03-breaking-the-code-how-to-use-hashcat-for-effective-password-cracking-15f8da8facb8/", "type": "article", "domain": "offensive-research" }, { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:python.org:d262ce15f4202a8d", "title": "official Python website", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.python.org/downloads", "publisher": "Python", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "python.org", "key": "publisher-domain:python.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 1. (basic, wizard)", "url": "https://1200km.com/articles/read/2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:fluentbit.io:35305e09665285d7", "title": "Official Site", "description": "External source cited by 1 maintained 1200km page.", "url": "https://fluentbit.io", "publisher": "Fluentbit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fluentbit.io", "key": "publisher-domain:fluentbit.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:xplg.com:e5391a45274dcaba", "title": "Official Site", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.xplg.com", "publisher": "XPLG", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "xplg.com", "key": "publisher-domain:xplg.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "type": "article", "domain": "identity-security" } ] }, { "id": "site-reference:censys.com:da7d93a410512dec", "title": "Official site here", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://censys.com", "publisher": "Censys", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "censys.com", "key": "publisher-domain:censys.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:b4ed192092b5c671", "title": "Official site here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/aboul3la/Sublist3r", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:f0fc55c5af56208c", "title": "Official site here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/laramies/theHarvester", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:nmap.org:df9f8e2951091d9a", "title": "Official site here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nmap.org", "publisher": "NMAP", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nmap.org", "key": "publisher-domain:nmap.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:owasp.org:af491a167341b735", "title": "Official site here", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://owasp.org/www-project-amass", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" }, { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:parrotsec.org:84e95f3122428a8d", "title": "Official site here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://parrotsec.org", "publisher": "Parrotsec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "parrotsec.org", "key": "publisher-domain:parrotsec.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:portswigger.net:4d5db9f35c0e1de8", "title": "Official site here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://portswigger.net/burp", "publisher": "Portswigger", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "portswigger.net", "key": "publisher-domain:portswigger.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:whatweb.net:7ebfb7cab49d169a", "title": "Official site here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://whatweb.net", "publisher": "Whatweb", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "whatweb.net", "key": "publisher-domain:whatweb.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:aircrack-ng.org:1884be10e39bf548", "title": "Official site here", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.aircrack-ng.org", "publisher": "Aircrack NG", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aircrack-ng.org", "key": "publisher-domain:aircrack-ng.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" }, { "title": "WiFi cracking with Aircrack-ng", "url": "https://1200km.com/articles/read/2024/2024-10-17-wifi-cracking-with-aircrack-ng-d51cf98c789f/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:hydradongle.com:d9f9a732e49d37be", "title": "Official site here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.hydradongle.com", "publisher": "Hydradongle", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "hydradongle.com", "key": "publisher-domain:hydradongle.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:kali.org:5a68f5d0832065c1", "title": "Official site here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.kali.org/tools/dirbuster", "publisher": "KALI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kali.org", "key": "publisher-domain:kali.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:openwall.com:56327f4ff3c22a62", "title": "Official site here", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.openwall.com/john", "publisher": "Openwall", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "openwall.com", "key": "publisher-domain:openwall.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" }, { "title": "ZIP file Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-zip-file-password-cracking-guide-with-real-life-examples-4e8705d51897/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:shodan.io:3aa22172dfdde8b3", "title": "Official site here", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://www.shodan.io", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "Integrating Shodan with HexStrike-AI Using Gemini-CLI", "url": "https://1200km.com/articles/read/2025/2025-12-23-integrating-shodan-with-hexstrike-ai-using-gemini-cli-b6f9fcbe8e6e/", "type": "article", "domain": "offensive-research" }, { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:zaproxy.org:aefeff3b44fad067", "title": "Official site here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.zaproxy.org", "publisher": "Zaproxy", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "zaproxy.org", "key": "publisher-domain:zaproxy.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:cirt.net:dc6fe3f670745491", "title": "Official site here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cirt.net/Nikto2", "publisher": "CIRT", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cirt.net", "key": "publisher-domain:cirt.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:kali.org:0ca01aaae5c494f4", "title": "Official site here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.kali.org", "publisher": "KALI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kali.org", "key": "publisher-domain:kali.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:metasploit.com:43c6c78c96e5f7c3", "title": "Official site here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.metasploit.com", "publisher": "Metasploit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "metasploit.com", "key": "publisher-domain:metasploit.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Ultimate Guide to Metasploit. Part 1.", "url": "https://1200km.com/articles/read/2024/2024-11-17-the-ultimate-guide-to-metasploit-part-1-43c8573487df/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:blackarch.org:3b715190358968a0", "title": "Official site is here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blackarch.org", "publisher": "Blackarch", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blackarch.org", "key": "publisher-domain:blackarch.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:searchlibrary.ohchr.org:0df19768f0a23d0e", "title": "OHCHR and UC Berkeley — Berkeley Protocol on Digital Open Source Investigations", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://searchlibrary.ohchr.org/record/30334?ln=en", "publisher": "Searchlibrary Ohchr", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "searchlibrary.ohchr.org", "key": "publisher-domain:searchlibrary.ohchr.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:github.com:519853e4d94a37c7", "title": "on the GitHub config repository", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/owasp-amass/config/blob/master/examples/config.yaml", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "OWASP Amass Project guide", "url": "https://1200km.com/articles/read/2024/2024-11-06-owasp-amass-project-guide-94bd55521f91/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:github.com:3cf53427ea696fad", "title": "openAI-research.md", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/blob/main/docs/source-gathering/openAI-research.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:openai.com:79aae2d11d487c9b", "title": "OpenAI, Disrupting deceptive uses of AI by covert influence operations", "description": "External source cited by 1 maintained 1200km page.", "url": "https://openai.com/index/disrupting-deceptive-uses-of-ai-by-covert-influence-operations", "publisher": "Openai", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:openai.com:d163670fb22ce1f9", "title": "OpenAI, Disrupting malicious uses of AI", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://openai.com/index/disrupting-malicious-ai-uses", "publisher": "Openai", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" }, { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:openai.com:3375c5d27d9b2838", "title": "OpenAI’s GPT-4 research report", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://openai.com/index/gpt-4-research", "publisher": "Openai", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:opencti.io:6aeca5caa578deb5", "title": "OpenCTI", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.opencti.io", "publisher": "Opencti", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "opencti.io", "key": "publisher-domain:opencti.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:docs.opencti.io:77bb2f0ceb0da3d1", "title": "OpenCTI documentation — Data model", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.opencti.io/latest/usage/data-model", "publisher": "DOCS Opencti", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.opencti.io", "key": "publisher-domain:docs.opencti.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:docs.opencti.io:749f38d0ada57133", "title": "OpenCTI documentation — Deduplication", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.opencti.io/latest/usage/deduplication", "publisher": "DOCS Opencti", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.opencti.io", "key": "publisher-domain:docs.opencti.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:docs.opencti.io:dd0ba306779eccce", "title": "OpenCTI documentation — GraphQL API", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.opencti.io/latest/reference/api", "publisher": "DOCS Opencti", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.opencti.io", "key": "publisher-domain:docs.opencti.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:f628027de732a070", "title": "opencti/connector-misp-feed", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/OpenCTI-Platform/connectors/tree/master/external-import/misp-feed", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:openphish.com:8c40743d5ebcdf1e", "title": "OpenPhish", "description": "External source cited by 1 maintained 1200km page.", "url": "https://openphish.com", "publisher": "Openphish", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "openphish.com", "key": "publisher-domain:openphish.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:scorecard.dev:5de7a2b3856be47b", "title": "OpenSSF Scorecard", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.scorecard.dev", "publisher": "Scorecard", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "scorecard.dev", "key": "publisher-domain:scorecard.dev" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" } ] }, { "id": "site-reference:opentelemetry.io:d2a4157cf13f7654", "title": "OpenTelemetry GenAI semantic conventions", "description": "External source cited by 1 maintained 1200km page.", "url": "https://opentelemetry.io/docs/specs/semconv/gen-ai", "publisher": "Opentelemetry", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "opentelemetry.io", "key": "publisher-domain:opentelemetry.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" } ] }, { "id": "site-reference:opentelemetry.io:478608b25a320697", "title": "OpenTelemetry logs", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://opentelemetry.io/docs/concepts/signals/logs", "publisher": "Opentelemetry", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "opentelemetry.io", "key": "publisher-domain:opentelemetry.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "ai-attack-reference:pub-086", "title": "Operation Endgame Quakes Rhadamanthys", "description": "Proofpoint operational CTI publication covering Identity fraud and impersonation, Obfuscation and evasion, and Command and control. Indexed with TA547, Cryptocurrency, and Anthropic context.", "url": "https://www.proofpoint.com/us/blog/threat-insight/operation-endgame-quakes-rhadamanthys", "publisher": "Proofpoint", "published_at": "2025-11-12", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Computer vision / OCR", "key": "ai-technology:computer-vision-/-ocr" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Malicious advertisement", "key": "attack-vector:malicious-advertisement" }, { "facet": "Campaign", "type": "campaign", "value": "Operation Endgame", "key": "campaign:operation-endgame" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$300 · medium confidence", "key": "metric:300-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$500 · medium confidence", "key": "metric:500-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1% · medium confidence", "key": "metric:1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "17% · medium confidence", "key": "metric:17-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "appeal[.]strike-submit[.]com", "key": "ioc:appeal-.-strike-submit-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "application-review[.]org", "key": "ioc:application-review-.-org" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "budparbanjarnegara[.]com", "key": "ioc:budparbanjarnegara-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "cashorix[.]xyz", "key": "ioc:cashorix-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "channel-review[.]org", "key": "ioc:channel-review-.-org" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "cloudwardena[.]com", "key": "ioc:cloudwardena-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "compliance-review[.]org", "key": "ioc:compliance-review-.-org" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "flaezguerad[.]com", "key": "ioc:flaezguerad-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "flaezguered[.]com", "key": "ioc:flaezguered-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "flaxergaurds[.]com", "key": "ioc:flaxergaurds-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "flcreagurade[.]com", "key": "ioc:flcreagurade-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "flenieregurd[.]com", "key": "ioc:flenieregurd-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "flheregurend[.]com", "key": "ioc:flheregurend-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "flnaresgurard[.]com", "key": "ioc:flnaresgurard-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "flsaregursd[.]com", "key": "ioc:flsaregursd-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "google[.]strike-submit[.]com", "key": "ioc:google-.-strike-submit-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security[.]flacergurad[.]com", "key": "ioc:security-.-flacergurad-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security[.]flaegrudad[.]com", "key": "ioc:security-.-flaegrudad-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security[.]flaezguerad[.]com", "key": "ioc:security-.-flaezguerad-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security[.]flaezguered[.]com", "key": "ioc:security-.-flaezguered-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security[.]flavregurads[.]com", "key": "ioc:security-.-flavregurads-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security[.]flheregurend[.]com", "key": "ioc:security-.-flheregurend-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security[.]flqaergwaard[.]com", "key": "ioc:security-.-flqaergwaard-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security[.]flsaregursd[.]com", "key": "ioc:security-.-flsaregursd-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "security[.]gueradflwre[.]com", "key": "ioc:security-.-gueradflwre-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "strike-submit[.]com", "key": "ioc:strike-submit-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "submit-appeal[.]com", "key": "ioc:submit-appeal-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "support-review[.]org", "key": "ioc:support-review-.-org" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "tdsworkout[.]com", "key": "ioc:tdsworkout-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "theguardshield[.]com", "key": "ioc:theguardshield-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "trust-review[.]org", "key": "ioc:trust-review-.-org" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "xoiiasdpsdoasdpojas[.]com", "key": "ioc:xoiiasdpsdoasdpojas-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "xpoalswwkjddsljsy[.]com", "key": "ioc:xpoalswwkjddsljsy-.-com" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "13f0bf908679bea560806fd3c14ef581b3cadbab2ff07a6adf04d97995924707", "key": "ioc:13f0bf908679bea560806fd3c14ef581b3cadbab2ff07a6adf04d97995924707" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b0c9d619256fdf220fbb39945fac5a040b5e836f1eae0459b4fcbf2b451420a7", "key": "ioc:b0c9d619256fdf220fbb39945fac5a040b5e836f1eae0459b4fcbf2b451420a7" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "bc2508708feb0ccc652494f8e28620bd871a8b6e1d26c7cdd61ab070f2594bbc", "key": "ioc:bc2508708feb0ccc652494f8e28620bd871a8b6e1d26c7cdd61ab070f2594bbc" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c9026ffc02f11204ac1eb1183376a5cee74f7897d948bdcd59c06f31de2671fa", "key": "ioc:c9026ffc02f11204ac1eb1183376a5cee74f7897d948bdcd59c06f31de2671fa" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "ccdd8a6dc97eeba07e586f059eae7944dd767519f2c3b2233ff90d3dc4e8e3f0", "key": "ioc:ccdd8a6dc97eeba07e586f059eae7944dd767519f2c3b2233ff90d3dc4e8e3f0" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "ff14b28408121ebe4a5d0c2f14b9dc99e987e89b56392dc214481197d4815456", "key": "ioc:ff14b28408121ebe4a5d0c2f14b9dc99e987e89b56392dc214481197d4815456" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "DanaBot", "key": "malware-or-tool:danabot" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "DarkGate", "key": "malware-or-tool:darkgate" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Lumma", "key": "malware-or-tool:lumma" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Remcos", "key": "malware-or-tool:remcos" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Rhadamanthys", "key": "malware-or-tool:rhadamanthys" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Screenshotter", "key": "malware-or-tool:screenshotter" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Proofpoint", "key": "publisher:proofpoint" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "proofpoint.com", "key": "publisher-domain:proofpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "TA547", "key": "threat-group:ta547" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA2541", "key": "threat-group-identifier:ta2541" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA547", "key": "threat-group-identifier:ta547" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA571", "key": "threat-group-identifier:ta571" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA585", "key": "threat-group-identifier:ta585" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA866", "key": "threat-group-identifier:ta866" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Malicious advertising", "key": "ttp:malicious-advertising" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-031", "title": "OPWNAI : Cybercriminals Starting to Use ChatGPT - Check Point Research", "description": "Check Point provider or government report covering Malware development, Malware generation, and Phishing link or attachment. Indexed with Cryptocurrency and OpenAI context.", "url": "https://research.checkpoint.com/2023/opwnai-cybercriminals-starting-to-use-chatgpt/", "publisher": "Check Point", "published_at": "2023-01-06", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Check Point", "key": "publisher:check-point" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2023", "key": "year:2023" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "site-reference:sqlmap.org:a0ab4ec16abbe143", "title": "Or download from here:", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://sqlmap.org", "publisher": "Sqlmap", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sqlmap.org", "key": "publisher-domain:sqlmap.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 1. (basic, wizard)", "url": "https://1200km.com/articles/read/2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83/", "type": "article", "domain": "offensive-research" }, { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:a5fccfe70fc768d7", "title": "Original Medium publication", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmware-8a151f8d5f1b", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Embedded Systems, Hardware, Firmware", "url": "https://1200km.com/embedded-systems-hardware-firmware/", "type": "mirror", "domain": "application-security" } ] }, { "id": "site-reference:osqa-ask.wireshark.org:4cb52b2b64d70be8", "title": "osqa-ask.wireshark.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://osqa-ask.wireshark.org/questions/58016/how-to-detect-arp-spoofing", "publisher": "OSQA ASK Wireshark", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "osqa-ask.wireshark.org", "key": "publisher-domain:osqa-ask.wireshark.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" } ], "used_in": [ { "title": "Protocol-Level Network Threat Hunting: A Wireshark-Centric Guide", "url": "https://1200km.com/articles/read/2025/2025-12-12-protocol-level-network-threat-hunting-a-wireshark-centric-guide-a6770ffc96c6/", "type": "article", "domain": "threat-hunting" } ] }, { "id": "site-reference:osquery.io:d4af80dd31f75105", "title": "osquery", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://osquery.io", "publisher": "Osquery", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "osquery.io", "key": "publisher-domain:osquery.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:google.github.io:3185f70d981a3290", "title": "OSS-Fuzz", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://google.github.io/oss-fuzz", "publisher": "Google Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "google.github.io", "key": "publisher-domain:google.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:google.github.io:960842c13327ad33", "title": "OSS-Fuzz getting started", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://google.github.io/oss-fuzz/getting-started", "publisher": "Google Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "google.github.io", "key": "publisher-domain:google.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:genai.owasp.org:b17aa157f214d368", "title": "OWASP Agentic Security Initiative", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://genai.owasp.org/initiatives/agentic-security-initiative", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:owasp.org:741621d508bf9367", "title": "OWASP API Security Top 10:2023", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://owasp.org/API-Security", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" } ] }, { "id": "site-reference:owasp.org:506b58859c44dc60", "title": "OWASP ASVS for the backend", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://owasp.org/www-project-application-security-verification-standard", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" } ] }, { "id": "site-reference:genai.owasp.org:34e40cc95699745a", "title": "OWASP GenAI Security Project", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://genai.owasp.org", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Engineering", "url": "https://1200km.com/ai-security-course.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:cheatsheetseries.owasp.org:f4c7d330ae1e2746", "title": "OWASP Kubernetes Security Cheat Sheet", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Kubernetes_Security_Cheat_Sheet.html", "publisher": "Cheatsheetseries Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cheatsheetseries.owasp.org", "key": "publisher-domain:cheatsheetseries.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Building a Vulnerable Kubernetes Lab: A Complete Guide to 25 Critical Security Issues", "url": "https://1200km.com/articles/read/2026/2026-02-02-building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:owasp.org:306d3cd51b913724", "title": "OWASP LLM Verification Standard", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://owasp.org/www-project-llm-verification-standard", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" } ] }, { "id": "site-reference:mas.owasp.org:4a9c57f9b2e3e74d", "title": "OWASP MASVS", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://mas.owasp.org/MASVS", "publisher": "MAS Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mas.owasp.org", "key": "publisher-domain:mas.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:owasp.org:0d2ab8418b4d49a3", "title": "OWASP TCASVS", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://owasp.org/TCASVS", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:owasp.org:bfa949069b40f189", "title": "OWASP Top 10 2021", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://owasp.org/www-project-top-ten", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "From Bugs to Breaches: Learning Secure Coding Through the OWASP Top 10", "url": "https://1200km.com/articles/read/2025/2025-08-31-from-bugs-to-breaches-learning-secure-coding-through-the-owasp-top-10-21b425fafb83/", "type": "article", "domain": "application-security" }, { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:genai.owasp.org:10c13a717f74a2cc", "title": "OWASP Top 10 for LLM Applications 2025", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI Security", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "type": "guide", "domain": "ai-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" } ] }, { "id": "site-reference:owasp.org:10e5cc9ce4c92f92", "title": "OWASP Top 10:2025", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://owasp.org/Top10", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" } ] }, { "id": "site-reference:owasp.org:96c90bf86610ca0a", "title": "OWASP Web Security Testing Guide", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://owasp.org/www-project-web-security-testing-guide", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:zaproxy.org:c5cf421208783afb", "title": "OWASP ZAP’s download page", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.zaproxy.org/download", "publisher": "Zaproxy", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "zaproxy.org", "key": "publisher-domain:zaproxy.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "OWASP ZAP: A Comprehensive Guide to Web Application Security Testing", "url": "https://1200km.com/articles/read/2024/2024-11-12-owasp-zap-a-comprehensive-guide-to-web-application-security-testing-6c247f4be39b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:genai.owasp.org:b300d98c112e4742", "title": "OWASP, GenAI Red Teaming Initiative", "description": "External source cited by 1 maintained 1200km page.", "url": "https://genai.owasp.org/initiatives/genai-red-teaming-initiative", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:genai.owasp.org:742d684f9b9a8133", "title": "OWASP, LLM01:2025 Prompt Injection", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" }, { "title": "Red Team & Offensive Security", "url": "https://1200km.com/cyber-knowledge/red-team.html", "type": "guide", "domain": "offensive-research" } ] }, { "id": "site-reference:genai.owasp.org:25abe4c8b650ca54", "title": "OWASP, LLM05:2025 Improper Output Handling", "description": "External source cited by 1 maintained 1200km page.", "url": "https://genai.owasp.org/llmrisk/llm052025-improper-output-handling", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:genai.owasp.org:cecce92d753337bd", "title": "OWASP, LLM06:2025 Excessive Agency", "description": "External source cited by 1 maintained 1200km page.", "url": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:genai.owasp.org:f90b248bfdcd0702", "title": "OWASP, LLM10:2025 Unbounded Consumption", "description": "External source cited by 1 maintained 1200km page.", "url": "https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:owasp.org:1c29ecf0684a2dcf", "title": "owasp.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://owasp.org", "publisher": "Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "owasp.org", "key": "publisher-domain:owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Complete Guide to AI-Driven Penetration Testing: Cursor, MCP, and the Modern PT Workflow", "url": "https://1200km.com/articles/read/2026/2026-02-19-the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:p1sec.com:1339f583b7f8cc6d", "title": "p1sec.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.p1sec.com/blog/penetration-testing-for-ss7-diameter-gtp-why-telco-protocols-demand-specialized-offensive-security", "publisher": "P1sec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "p1sec.com", "key": "publisher-domain:p1sec.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:p1sec.com:0cc7294bb96d8ff3", "title": "p1sec.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.p1sec.com/blog/understanding-the-vulnerabilities-of-the-diameter-protocol-in-4g-networks", "publisher": "P1sec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "p1sec.com", "key": "publisher-domain:p1sec.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:4d0eacde109a2b8b", "title": "Palo Alto Unit 42 — Muddying the Water: Targeted Attacks in the Middle East", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:raw.githubusercontent.com:749183b3e87b812d", "title": "palo-alto/dns-queries.csv", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/palo-alto/dns-queries.csv", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:raw.githubusercontent.com:196223f9d5e8c030", "title": "palo-alto/ngfw-flows.csv", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/palo-alto/ngfw-flows.csv", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:par.nsf.gov:747c8ed356040782", "title": "par.nsf.gov", "description": "External source cited by 1 maintained 1200km page.", "url": "https://par.nsf.gov/servlets/purl/10057394", "publisher": "PAR NSF", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "par.nsf.gov", "key": "publisher-domain:par.nsf.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:markdown2medium.vercel.app:fb652223194886ba", "title": "Part 2B → Gate B: Scenario Approval", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://markdown2medium.vercel.app", "publisher": "Markdown2medium Vercel", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "markdown2medium.vercel.app", "key": "publisher-domain:markdown2medium.vercel.app" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:passwordmonster.com:58f19f3692cfad3c", "title": "Password Monster", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.passwordmonster.com", "publisher": "Passwordmonster", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "passwordmonster.com", "key": "publisher-domain:passwordmonster.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:thomsonreuters.com:b6f657ccbd895952", "title": "patchmypc.com+3thomsonreuters.com+3learn.microsoft.com+3", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.thomsonreuters.com/content/helpandsupp/en-us/help/gofileroom/get-started/set-up/process-monitor-procmon-installation.html", "publisher": "Thomsonreuters", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "thomsonreuters.com", "key": "publisher-domain:thomsonreuters.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:paubox.com:d7f7104eee6e2222", "title": "paubox.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.paubox.com/blog/2024-phishing-statistics-latest-figures-and-trends", "publisher": "Paubox", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "paubox.com", "key": "publisher-domain:paubox.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:pcisecuritystandards.org:0653d70af613d6ea", "title": "PCI SSC document library — PCI DSS v4.0.1", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.pcisecuritystandards.org/document_library/?class=pcidss&doc=pci_dss", "publisher": "Pcisecuritystandards", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "pcisecuritystandards.org", "key": "publisher-domain:pcisecuritystandards.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:pefile.readthedocs.io:75d333eef4838515", "title": "pefile project documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://pefile.readthedocs.io", "publisher": "Pefile Readthedocs", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "pefile.readthedocs.io", "key": "publisher-domain:pefile.readthedocs.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:aws.amazon.com:8857152dc52d332c", "title": "Persistent storage for container logging using Fluent Bit and Amazon EFS | Amazon Web Services", "description": "External source cited by 1 maintained 1200km page.", "url": "https://aws.amazon.com/ru/blogs/storage/persistent-storage-for-container-logging-using-fluent-bit-and-amazon-efs", "publisher": "AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aws.amazon.com", "key": "publisher-domain:aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:phishingbox.com:46960e6aac075674", "title": "phishingbox.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.phishingbox.com/news/post/2023-verizon-data-breach-investigations-report-industry-specific-breakdown", "publisher": "Phishingbox", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "phishingbox.com", "key": "publisher-domain:phishingbox.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:picussecurity.com:2333e04a55b2327b", "title": "picussecurity.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.picussecurity.com/resource/blog/the-ten-most-common-kubernetes-security-misconfigurations-how-to-address-them", "publisher": "Picussecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "picussecurity.com", "key": "publisher-domain:picussecurity.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:arxiv.org:c56dd4629efd9274", "title": "Pierazzi et al. — Intriguing Properties of Adversarial ML Attacks in the Problem Space", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1911.02142", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:thehackernews.com:9b897ad8ed85bb62", "title": "PixieFail", "description": "External source cited by 1 maintained 1200km page.", "url": "https://thehackernews.com/2024/01/pixiefail-uefi-flaws-expose-millions-of.html", "publisher": "Thehackernews", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "thehackernews.com", "key": "publisher-domain:thehackernews.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:portswigger.net:3cee68b8e2c3788f", "title": "portswiggers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://portswigger.net/web-security/all-labs", "publisher": "Portswigger", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "portswigger.net", "key": "publisher-domain:portswigger.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Cracking Web Interfaces with Burp Suite: A Comprehensive Tutorial", "url": "https://1200km.com/articles/read/2024/2024-10-24-cracking-web-interfaces-with-burp-suite-a-comprehensive-tutorial-33087bb286b0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:d3d471550feec48e", "title": "PPG Personal Pass Generator", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/Passwords/blob/main/PPG_personal_pass_generator.py", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Personal Pass Generator (PPG): The Ultimate Tool for Custom Password Lists", "url": "https://1200km.com/articles/read/2024/2024-10-20-personal-pass-generator-ppg-the-ultimate-tool-for-custom-password-lists-4979a3a1385c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:genai.owasp.org:adcb8cf9050cfe65", "title": "Practical Guide for Secure MCP Server Development", "description": "External source cited by 1 maintained 1200km page.", "url": "https://genai.owasp.org/resource/a-practical-guide-for-secure-mcp-server-development", "publisher": "Genai Owasp", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "genai.owasp.org", "key": "publisher-domain:genai.owasp.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-105", "title": "Predator AI | ChatGPT-Powered Infostealer Takes Aim at Cloud Platforms | SentinelOne", "description": "SentinelOne operational CTI publication covering Command and control. Indexed with Telecommunications and OpenAI context.", "url": "https://www.sentinelone.com/labs/predator-ai-chatgpt-powered-infostealer-takes-aim-at-cloud-platforms/", "publisher": "SentinelOne", "published_at": "2023-11-07", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "abuseipdb[.]com", "key": "ioc:abuseipdb-.-com" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "88d40f86eefee5112515b73cce2d2badb7f49ffd", "key": "ioc:88d40f86eefee5112515b73cce2d2badb7f49ffd" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "Predator AI", "key": "malicious-ai-tool:predator-ai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "SentinelOne", "key": "publisher:sentinelone" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "Year", "type": "year", "value": "2023", "key": "year:2023" } ], "used_in": [] }, { "id": "site-reference:wiz.io:664ba8816a558ca1", "title": "Primary research", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak", "publisher": "WIZ", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "wiz.io", "key": "publisher-domain:wiz.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:kubernetes.io:8d1e2519f096c2a7", "title": "Projected Volumes | Kubernetes", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/concepts/storage/projected-volumes", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-106", "title": "Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware | SentinelOne", "description": "SentinelOne operational CTI publication covering Malware development, Obfuscation and evasion, and Translation and localization. Indexed with APT28 / Fancy Bear, Education, and Anthropic context.", "url": "https://www.sentinelone.com/labs/prompts-as-code-embedded-keys-the-hunt-for-llm-enabled-malware/", "publisher": "SentinelOne", "published_at": "2025-09-19", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "more than 7,000 samples · medium confidence", "key": "metric:more-than-7-000-samples-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "2 years · medium confidence", "key": "metric:2-years-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "09bf891b7b35b2081d3ebca8de715da07a70151227ab55aec1da26eb769c006f", "key": "ioc:09bf891b7b35b2081d3ebca8de715da07a70151227ab55aec1da26eb769c006f" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "1458b6dc98a878f237bfb3c3f354ea6e12d76e340cefe55d6a1c9c7eb64c9aee", "key": "ioc:1458b6dc98a878f237bfb3c3f354ea6e12d76e340cefe55d6a1c9c7eb64c9aee" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "1612ab799df51a7f1169d3f47ea129356b42c8ad81286d05b0256f80c17d4089", "key": "ioc:1612ab799df51a7f1169d3f47ea129356b42c8ad81286d05b0256f80c17d4089" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "165eaf8183f693f644a8a24d2ec138cd4f8d9fd040e8bafc1b021a0f973692dd", "key": "ioc:165eaf8183f693f644a8a24d2ec138cd4f8d9fd040e8bafc1b021a0f973692dd" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "2755e1ec1e4c3c0cd94ebe43bd66391f05282b6020b2177ee3b939fdd33216f6", "key": "ioc:2755e1ec1e4c3c0cd94ebe43bd66391f05282b6020b2177ee3b939fdd33216f6" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "2eb18873273e157a7244bb165d53ea3637c76087eea84b0ab635d04417ffbe1b", "key": "ioc:2eb18873273e157a7244bb165d53ea3637c76087eea84b0ab635d04417ffbe1b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "3082156a26534377a8a8228f44620a5bb00440b37b0cf7666c63c542232260f2", "key": "ioc:3082156a26534377a8a8228f44620a5bb00440b37b0cf7666c63c542232260f2" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "384e8f3d300205546fb8c9b9224011b3b3cb71adc994180ff55e1e6416f65715", "key": "ioc:384e8f3d300205546fb8c9b9224011b3b3cb71adc994180ff55e1e6416f65715" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "3afbb9fe6bab2cad83c52a3f1a12e0ce979fe260c55ab22a43c18035ff7d7f38", "key": "ioc:3afbb9fe6bab2cad83c52a3f1a12e0ce979fe260c55ab22a43c18035ff7d7f38" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "4c73717d933f6b53c40ed1b211143df8d011800897be1ceb5d4a2af39c9d4ccc", "key": "ioc:4c73717d933f6b53c40ed1b211143df8d011800897be1ceb5d4a2af39c9d4ccc" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "4ddbc14d8b6a301122c0ac6e22aef6340f45a3a6830bcdacf868c755a7162216", "key": "ioc:4ddbc14d8b6a301122c0ac6e22aef6340f45a3a6830bcdacf868c755a7162216" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "5ab16a59b12c7c5539d9e22a090ba6c7942fbc5ab8abbc5dffa6b6de6e0f2fc6", "key": "ioc:5ab16a59b12c7c5539d9e22a090ba6c7942fbc5ab8abbc5dffa6b6de6e0f2fc6" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "5f6bfdd430a23afdc518857dfff25a29d85ead441dfa0ee363f4e73f240c89f4", "key": "ioc:5f6bfdd430a23afdc518857dfff25a29d85ead441dfa0ee363f4e73f240c89f4" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "68ca559bf6654c7ca96c10abb4a011af1f4da0e6d28b43186d1d48d2f936684c", "key": "ioc:68ca559bf6654c7ca96c10abb4a011af1f4da0e6d28b43186d1d48d2f936684c" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "75b4ad99f33d1adbc0d71a9da937759e6e5788ad0f8a2c76a34690ef1c49ebf5", "key": "ioc:75b4ad99f33d1adbc0d71a9da937759e6e5788ad0f8a2c76a34690ef1c49ebf5" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777", "key": "ioc:766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "7bbb06479a2e554e450beb2875ea19237068aa1055a4d56215f4e9a2317f8ce6", "key": "ioc:7bbb06479a2e554e450beb2875ea19237068aa1055a4d56215f4e9a2317f8ce6" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "8013b23cb78407675f323d54b6b8dfb2a61fb40fb13309337f5b662dbd812a5d", "key": "ioc:8013b23cb78407675f323d54b6b8dfb2a61fb40fb13309337f5b662dbd812a5d" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "854b559bae2ce8700edd75808267cfb5f60d61ff451f0cf8ec1d689334ac8d0b", "key": "ioc:854b559bae2ce8700edd75808267cfb5f60d61ff451f0cf8ec1d689334ac8d0b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "943d3537730e41e0a6fe8048885a07ea2017847558a916f88c2c9afe32851fe6", "key": "ioc:943d3537730e41e0a6fe8048885a07ea2017847558a916f88c2c9afe32851fe6" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "a30930dfb655aa39c571c163ada65ba4dec30600df3bf548cc48bedd0e841416", "key": "ioc:a30930dfb655aa39c571c163ada65ba4dec30600df3bf548cc48bedd0e841416" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "a32a3751dfd4d7a0a66b7ecbd9bacb5087076377d486afdf05d3de3cb7555501", "key": "ioc:a32a3751dfd4d7a0a66b7ecbd9bacb5087076377d486afdf05d3de3cb7555501" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "a67465075c91bb15b81e1f898f2b773196d3711d8e1fb321a9d6647958be436b", "key": "ioc:a67465075c91bb15b81e1f898f2b773196d3711d8e1fb321a9d6647958be436b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "ae6ed1721d37477494f3f755c124d53a7dd3e24e98c20f3a1372f45cc8130989", "key": "ioc:ae6ed1721d37477494f3f755c124d53a7dd3e24e98c20f3a1372f45cc8130989" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b2bda70318af89b9e82751eb852ece626e2928b94ac6af6e6c7031b3d016ebd2", "key": "ioc:b2bda70318af89b9e82751eb852ece626e2928b94ac6af6e6c7031b3d016ebd2" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b3fcba809984eaffc5b88a1bcded28ac50e71965e61a66dd959792f7750b9e87", "key": "ioc:b3fcba809984eaffc5b88a1bcded28ac50e71965e61a66dd959792f7750b9e87" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b43e7d481c4fdc9217e17908f3a4efa351a1dab867ca902883205fe7d1aab5e7", "key": "ioc:b43e7d481c4fdc9217e17908f3a4efa351a1dab867ca902883205fe7d1aab5e7" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b49aa9efd41f82b34a7811a7894f0ebf04e1d9aab0b622e0083b78f54fe8b466", "key": "ioc:b49aa9efd41f82b34a7811a7894f0ebf04e1d9aab0b622e0083b78f54fe8b466" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "bb2836148527744b11671347d73ca798aca9954c6875082f9e1176d7b52b720f", "key": "ioc:bb2836148527744b11671347d73ca798aca9954c6875082f9e1176d7b52b720f" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3", "key": "ioc:bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c1a80983779d8408a9c303d403999a9aef8c2f0fe63f8b5ca658862f66f3db16", "key": "ioc:c1a80983779d8408a9c303d403999a9aef8c2f0fe63f8b5ca658862f66f3db16" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c5ae843e1c7769803ca70a9d5b5574870f365fb139016134e5dd3cb1b1a65f5f", "key": "ioc:c5ae843e1c7769803ca70a9d5b5574870f365fb139016134e5dd3cb1b1a65f5f" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c86a5fcefbf039a72bd8ad5dc70bcb67e9c005f40a7bacd2f76c793f85e9a061", "key": "ioc:c86a5fcefbf039a72bd8ad5dc70bcb67e9c005f40a7bacd2f76c793f85e9a061" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "cf4d430d0760d59e2fa925792f9e2b62d335eaf4d664d02bff16dd1b522a462a", "key": "ioc:cf4d430d0760d59e2fa925792f9e2b62d335eaf4d664d02bff16dd1b522a462a" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "d1b48715ace58ee3bfb7af34066491263b885bd865863032820dccfe184614ad", "key": "ioc:d1b48715ace58ee3bfb7af34066491263b885bd865863032820dccfe184614ad" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e", "key": "ioc:d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "dc9f49044d16abfda299184af13aa88ab2c0fda9ca7999adcdbd44e3c037a8b1", "key": "ioc:dc9f49044d16abfda299184af13aa88ab2c0fda9ca7999adcdbd44e3c037a8b1" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "e24fe0dd0bf8d3943d9c4282f172746af6b0787539b371e6626bdb86605ccd70", "key": "ioc:e24fe0dd0bf8d3943d9c4282f172746af6b0787539b371e6626bdb86605ccd70" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "e88a7b9ad5d175383d466c5ad7ebd7683d60654d2fa2aca40e2c4eb9e955c927", "key": "ioc:e88a7b9ad5d175383d466c5ad7ebd7683d60654d2fa2aca40e2c4eb9e955c927" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "DeepSeek", "key": "llm-model:deepseek" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM model", "type": "llm_model", "value": "Mistral / Mixtral", "key": "llm-model:mistral-/-mixtral" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "DeepSeek", "key": "llm-provider:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Mistral AI", "key": "llm-provider:mistral-ai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "xAI", "key": "llm-provider:xai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "FraudGPT", "key": "malicious-ai-tool:fraudgpt" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "LAMEHUG", "key": "malware-or-tool:lamehug" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PromptSteal", "key": "malware-or-tool:promptsteal" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PromptSteal malware", "key": "malware-or-tool:promptsteal-malware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "SentinelOne", "key": "publisher:sentinelone" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Target", "type": "target", "value": "Security researchers", "key": "target:security-researchers" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT28", "key": "threat-group-identifier:apt28" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:proofpoint.com:58a7d55dcedf7221", "title": "Proofpoint — Around the World in 90 Days: State-Sponsored Actors Try ClickFix", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix", "publisher": "Proofpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "proofpoint.com", "key": "publisher-domain:proofpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:proofpoint.com:cf9e770e962ab606", "title": "Proofpoint — Crossed Wires: a case study of Iranian espionage and attribution", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution", "publisher": "Proofpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "proofpoint.com", "key": "publisher-domain:proofpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:proofpoint.com:2d95a591035be676", "title": "Proofpoint — TA450 Uses Embedded Links in PDF Attachments in Latest Campaign", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign", "publisher": "Proofpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "proofpoint.com", "key": "publisher-domain:proofpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:proofpoint.com:515bfe0a8ce973b1", "title": "proofpoint.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.proofpoint.com/us/corporate-blog/post/shark-tanks-barbara-corcoran-loses-nearly-400k-bec-attack-what-you-need-know", "publisher": "Proofpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "proofpoint.com", "key": "publisher-domain:proofpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:learn.microsoft.com:5d8597a2e640f9db", "title": "Protecting Microsoft 365 from on-premises attacks", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/en-us/entra/architecture/protect-m365-from-on-premises-attacks", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "ITDR Professional Roadmap", "url": "https://1200km.com/ITDR/docs/roadmap/", "type": "documentation", "domain": "identity-security" } ] }, { "id": "site-reference:fortinet.com:666288dbc56d2e0b", "title": "PSIRT threat-actor activity analysis", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.fortinet.com/blog/psirt-blogs", "publisher": "Fortinet", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fortinet.com", "key": "publisher-domain:fortinet.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:medium.com:b842fe9e6995ea37", "title": "Published Medium article: How to Build a Safe Malware Analysis Lab", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "How to Build a Safe Malware Analysis Lab with FLARE-VM, REMnux, and INetSim", "url": "https://1200km.com/articles/read/2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:securitylab.github.com:3743d2da2793ac67", "title": "pwn request writeup", "description": "External source cited by 1 maintained 1200km page.", "url": "https://securitylab.github.com/resources/github-actions-preventing-pwn-requests", "publisher": "Securitylab Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "securitylab.github.com", "key": "publisher-domain:securitylab.github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:4468f4f0fe234e66", "title": "pySigma", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/SigmaHQ/pySigma", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-081", "title": "Q1 2024 Threat Landscape Report: Insider Threat & Phishing Evolve Under AI Auspices", "description": "Kroll research publication covering Deepfake video or image, Deepfake voice, and Identity fraud and impersonation. Indexed with Akira and Financial Services context.", "url": "https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/q1-2024-threat-landscape-report-insider-threat-phishing-evolve-under-ai", "publisher": "Kroll", "published_at": "2024-05-22", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-36025", "key": "cve:cve-2023-36025" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-1708", "key": "cve:cve-2024-1708" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-1709", "key": "cve:cve-2024-1709" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-21412", "key": "cve:cve-2024-21412" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "48 hours · medium confidence", "key": "metric:48-hours-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11% · medium confidence", "key": "metric:11-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "13% · medium confidence", "key": "metric:13-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "15% · medium confidence", "key": "metric:15-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "24% · medium confidence", "key": "metric:24-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "27% · medium confidence", "key": "metric:27-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3% · medium confidence", "key": "metric:3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5% · medium confidence", "key": "metric:5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6% · medium confidence", "key": "metric:6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8% · medium confidence", "key": "metric:8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "9% · medium confidence", "key": "metric:9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "90% · medium confidence", "key": "metric:90-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "AKIRA ransomware", "key": "malware-or-tool:akira-ransomware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "DarkGate", "key": "malware-or-tool:darkgate" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "PLAY ransomware", "key": "malware-or-tool:play-ransomware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Kroll", "key": "publisher:kroll" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "kroll.com", "key": "publisher-domain:kroll.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "requires manual relevance review", "key": "relevance-basis:requires-manual-relevance-review" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "research publication", "key": "source-type:research-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "do_not_aggregate", "key": "statistical-use:do-not-aggregate" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "Akira", "key": "threat-group:akira" }, { "facet": "Threat group", "type": "threat_group", "value": "APT43 / Kimsuky", "key": "threat-group:apt43-/-kimsuky" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "site-reference:github.com:161bbbdc40b88370", "title": "Qiling", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/qilingframework/qiling", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Unpacker: A Practical Guide to Modular Malware Packer Detection and Unpacking", "url": "https://1200km.com/articles/read/2026/2026-02-28-unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:blog.quarkslab.com:fe4436abc815a1c0", "title": "Quarkslab PixieFail", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html", "publisher": "BLOG Quarkslab", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.quarkslab.com", "key": "publisher-domain:blog.quarkslab.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:query.ai:75b7988d6d2159ff", "title": "query.ai", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.query.ai/resources/blogs/cybersecurity-event-data-normalization-standards", "publisher": "Query", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "query.ai", "key": "publisher-domain:query.ai" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:cybercom.mil:3fb10ca6b6465e6c", "title": "R1", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools", "publisher": "Cybercom", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cybercom.mil", "key": "publisher-domain:cybercom.mil" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:ncsc.gov.uk:48f2a29d22ef7eec", "title": "R1", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf", "publisher": "NCSC GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ncsc.gov.uk", "key": "publisher-domain:ncsc.gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:proofpoint.com:b6e316ab3d3616f2", "title": "R10", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.proofpoint.com/uk/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign", "publisher": "Proofpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "proofpoint.com", "key": "publisher-domain:proofpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:research.checkpoint.com:f44c33380d362a55", "title": "R11", "description": "External source cited by 1 maintained 1200km page.", "url": "https://research.checkpoint.com/2024/new-bugsleep-backdoor-deployed-in-recent-muddywater-campaigns", "publisher": "Research Checkpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:group-ib.com:d270f38554d1ace6", "title": "R13", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.group-ib.com/blog/muddywater-infrastructure-malware", "publisher": "Group IB", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "group-ib.com", "key": "publisher-domain:group-ib.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:blog.sekoia.io:3f96f3458d384fda", "title": "R14", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign", "publisher": "BLOG Sekoia", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.sekoia.io", "key": "publisher-domain:blog.sekoia.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:group-ib.com:416ff0901ffe2fe7", "title": "R17", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.group-ib.com/blog/muddywater-espionage", "publisher": "Group IB", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "group-ib.com", "key": "publisher-domain:group-ib.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cloudsek.com:9838814701607fd3", "title": "R19", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant", "publisher": "Cloudsek", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloudsek.com", "key": "publisher-domain:cloudsek.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:seqrite.com:37806e15db71bbc0", "title": "R19", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.seqrite.com/blog/ung0801-tracking-threat-clusters-obsessed-with-av-icon-spoofing-targeting-israel", "publisher": "Seqrite", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "seqrite.com", "key": "publisher-domain:seqrite.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:aws.amazon.com:2d913dde833e89ee", "title": "R22", "description": "External source cited by 1 maintained 1200km page.", "url": "https://aws.amazon.com/blogs/security/new-amazon-threat-intelligence-findings-nation-state-actors-bridging-cyber-and-kinetic-warfare", "publisher": "AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aws.amazon.com", "key": "publisher-domain:aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:ebe0b3b741c3c2e5", "title": "R23", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:trendmicro.com:38540b23b8c0c2e0", "title": "R24", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html", "publisher": "Trendmicro", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "trendmicro.com", "key": "publisher-domain:trendmicro.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:secureworks.com:1e950cc8b1f6ca77", "title": "R25", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.secureworks.com/research/threat-profiles/cobalt-ulster", "publisher": "Secureworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "secureworks.com", "key": "publisher-domain:secureworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:cyberthint.io:a5e3fc74fdc205f8", "title": "R26", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cyberthint.io/updated-muddywater-analysis-2025", "publisher": "Cyberthint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cyberthint.io", "key": "publisher-domain:cyberthint.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:f8cd59b3c244faed", "title": "R4", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/unit42-muddywater-operations-in-lebanon-and-oman", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:ncsc.gov.uk:5913f619868f60e4", "title": "R4", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ncsc.gov.uk/pdfs/news/joint-advisory-observes-muddywater-actors-conducting-cyber-espionage.pdf", "publisher": "NCSC GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ncsc.gov.uk", "key": "publisher-domain:ncsc.gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:learn.microsoft.com:1f3d79f73430bb71", "title": "R7", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://learn.microsoft.com/en-us/unified-secops/microsoft-threat-actor-naming", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:microsoft.com:b4f4a16d69691e07", "title": "R8", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.microsoft.com/en-gb/security/security-insider/intelligence-reports/iran-surges-cyber-enabled-influence-operations-in-support-of-hamas", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:blog.talosintelligence.com:b0a9130a7e2bb1b9", "title": "R9", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.talosintelligence.com/iranian-supergroup-muddywater", "publisher": "BLOG Talosintelligence", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.talosintelligence.com", "key": "publisher-domain:blog.talosintelligence.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:rapid7.com:ca50e4aebcd23ece", "title": "Rapid7 — Iran Conflict Cyber Threat Intelligence", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.rapid7.com/research/iran-conflict-cyber-threats", "publisher": "Rapid7", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "rapid7.com", "key": "publisher-domain:rapid7.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:rapid7.com:7f4dd9252e0745b6", "title": "Rapid7 — Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware", "publisher": "Rapid7", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "rapid7.com", "key": "publisher-domain:rapid7.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:rapid7.com:f0840dddea458bd3", "title": "Rapid7 State of Exposure Report 2024", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.rapid7.com/research/report/state-of-exposure", "publisher": "Rapid7", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "rapid7.com", "key": "publisher-domain:rapid7.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:github.com:1eed4afca27b4e96", "title": "raw-sources/", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/tree/main/docs/source-gathering/raw-sources", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:kubernetes.io:1398cb8bd140b8a8", "title": "RBAC Good Practices", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://kubernetes.io/docs/concepts/security/rbac-good-practices", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:ft.com:cc5ddf6de3a8aaab", "title": "Read here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ft.com/content/b977e8d4-664c-4ae4-8a8e-eb93bdf785ea", "publisher": "FT", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ft.com", "key": "publisher-domain:ft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "The 20x Employee: A Strategic Framework for Unlocking Hyper-Productivity with Artificial…", "url": "https://1200km.com/articles/read/2025/2025-08-01-the-20x-employee-a-strategic-framework-for-unlocking-hyper-productivity-with-artificial-8f49cde95a25/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:medium.com:ee84ac4826d7fbc8", "title": "Read on Medium ↗", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/ai-security-course-module-00-chapter-2-69381c74a59c?postPublishedType=repub", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:bce6e4bc3cb346d4", "title": "Read on Medium ↗", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://medium.com/@1200km/ai-security-course-module-00-chapter-3-1bf0411472f6", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:699c31c7493a65aa", "title": "Read the full article on Medium", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:db0e808bbc4a3262", "title": "README", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/blob/main/README.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:recordedfuture.com:3132b21604cb46e8", "title": "Recorded Future", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.recordedfuture.com", "publisher": "Recordedfuture", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "recordedfuture.com", "key": "publisher-domain:recordedfuture.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:redhat.com:ccb67afd7ee432b4", "title": "Red Hat Secure Boot certificate expiration (2026)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.redhat.com/en/blog/expiration-secure-boot-signing-certificates-2026", "publisher": "Redhat", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "redhat.com", "key": "publisher-domain:redhat.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:reddit.com:ddf569eb8e7a3280", "title": "reddit.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.reddit.com/r/cybersecurity/comments/1l7yvr9/are_there_really_any_real_life_incidents_that_are", "publisher": "Reddit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "reddit.com", "key": "publisher-domain:reddit.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:ic3.gov:1ffcb3b81b5e5779", "title": "Reducing the Attack Surface for End-of-Support Edge Devices (joint fact sheet, PDF)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.ic3.gov/CSA/2026/260205.pdf", "publisher": "IC3", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ic3.gov", "key": "publisher-domain:ic3.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:portableapps.com:160f8d2abc1f7cfd", "title": "regshot.informer.com+6portableapps.com+6regshot.en.lo4d.com+6", "description": "External source cited by 1 maintained 1200km page.", "url": "https://portableapps.com/apps/utilities/regshot_portable", "publisher": "Portableapps", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "portableapps.com", "key": "publisher-domain:portableapps.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:eur-lex.europa.eu:b70dd85399aee628", "title": "Regulation (EU) 2016/679 — GDPR", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "publisher": "EUR LEX Europa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eur-lex.europa.eu", "key": "publisher-domain:eur-lex.europa.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:eur-lex.europa.eu:d517fc5e212b6070", "title": "Regulation (EU) 2022/2554 — DORA", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "publisher": "EUR LEX Europa", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "eur-lex.europa.eu", "key": "publisher-domain:eur-lex.europa.eu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "security-governance", "key": "used-by-topic:security-governance" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "type": "guide", "domain": "security-governance" } ] }, { "id": "site-reference:github.com:5a0649e2c0a9ee08", "title": "Release AdversaryGraph v4.0.0 · anpa1200/adversarygraph", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph/releases/tag/v4.0.0", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "AdversaryGraph v4.0: I Added a Full Malware Analysis Workbench to My Self-Hosted CTI Platform", "url": "https://1200km.com/articles/read/2026/2026-06-26-adversarygraph-v4-0-i-added-a-full-malware-analysis-workbench-to-my-self-hosted-cti-platfo-8dfbf1db2c9e/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:afcdbbd8a9153331", "title": "Release AdversaryGraph v5.0.0 · anpa1200/adversarygraph", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph/releases/tag/v5.0.0", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "AdversaryGraph v5.0: From CTI Mapping to Attack Simulation and SIEM Validation", "url": "https://1200km.com/articles/read/2026/2026-06-29-adversarygraph-v5-0-from-cti-mapping-to-attack-simulation-and-siem-validation-21873b2a6c39/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:79fec1d2d63023c3", "title": "Release AdversaryGraph v6.0.0 · anpa1200/adversarygraph", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph/releases/tag/v6.0.0", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "AdversaryGraph", "url": "https://1200km.com/articles/read/2026/2026-07-23-adversarygraph-40df3439b90c/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:9cf53448b1153463", "title": "Release ThreatMapper v2.0.0 · anpa1200/threatmapper", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/threatmapper/releases/tag/v2.0.0", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AdversaryGraph v2.0: I Built a Self-Hosted AI Threat Intelligence Platform", "url": "https://1200km.com/articles/read/2026/2026-06-16-adversarygraph-v2-0-i-built-a-self-hosted-ai-threat-intelligence-platform-941a80cc5a65/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:461ced14955cc018", "title": "relevant-research-list.md", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/blob/main/docs/source-gathering/relevant-research-list.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:docs.remnux.org:6205368614de6070", "title": "REMnux documentation", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://docs.remnux.org", "publisher": "DOCS Remnux", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.remnux.org", "key": "publisher-domain:docs.remnux.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "How to Build a Safe Malware Analysis Lab with FLARE-VM, REMnux, and INetSim", "url": "https://1200km.com/articles/read/2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602/", "type": "article", "domain": "malware-analysis" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:docs.remnux.org:877b12698bcdfe23", "title": "REMnux documentation: network-interaction services", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.remnux.org/discover-the-tools/explore%2Bnetwork%2Binteractions/services", "publisher": "DOCS Remnux", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.remnux.org", "key": "publisher-domain:docs.remnux.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "How to Build a Safe Malware Analysis Lab with FLARE-VM, REMnux, and INetSim", "url": "https://1200km.com/articles/read/2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:cloud.google.com:e07373d804e8a763", "title": "Repeated Fields in YARA-L 2.0 | Google Security Operations | Google Cloud", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/chronicle/docs/yara-l/repeated-fields", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:research.checkpoint.com:a58c2ab615f4e76f", "title": "research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel", "publisher": "Research Checkpoint", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" }, { "title": "Attribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution", "url": "https://1200km.com/articles/read/2026/2026-03-20-attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:research.splunk.com:a22574e35bfcdc80", "title": "research.splunk.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://research.splunk.com/endpoint/4b00f134-6d6a-11ec-a90c-acde48001122", "publisher": "Research Splunk", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.splunk.com", "key": "publisher-domain:research.splunk.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:kubernetes.io:76fd94a526a794b3", "title": "Restrict a Container’s Access to Resources with AppArmor | Kubernetes", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/tutorials/security/apparmor", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:datatracker.ietf.org:015e9ab8d6a9176c", "title": "RFC 3227", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://datatracker.ietf.org/doc/rfc3227", "publisher": "Datatracker IETF", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "datatracker.ietf.org", "key": "publisher-domain:datatracker.ietf.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:rfc-editor.org:6b1876607e73c2c4", "title": "RFC 9162 — Certificate Transparency Version 2.0", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.rfc-editor.org/rfc/rfc9162.html", "publisher": "RFC Editor", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "rfc-editor.org", "key": "publisher-domain:rfc-editor.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:arxiv.org:6c39d224a4a74a56", "title": "Richard Fang et al., LLM Agents can Autonomously Exploit One-day Vulnerabilities", "description": "External source cited by 1 maintained 1200km page.", "url": "https://arxiv.org/abs/2404.08144", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:arxiv.org:83213326f5835ccc", "title": "RoFormer: Enhanced Transformer with Rotary Position Embedding", "description": "External source cited by 1 maintained 1200km page.", "url": "https://arxiv.org/abs/2104.09864", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:iana.org:28e49fd71680c030", "title": "Root Zone Database", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.iana.org/domains/root/db", "publisher": "IANA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "iana.org", "key": "publisher-domain:iana.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:doi.org:a74e400d56cc8f7a", "title": "Rumelhart, Hinton, and Williams — Learning representations by back-propagating errors", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://doi.org/10.1038/323533a0", "publisher": "DOI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "doi.org", "key": "publisher-domain:doi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "ai-attack-reference:pub-056", "title": "Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite | CISA", "description": "CISA government or law-enforcement publication covering Obfuscation and evasion, Reconnaissance and target research, and Command and control. Indexed with Defense context.", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a", "publisher": "CISA", "published_at": "2026-06-23", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Campaign", "type": "campaign", "value": "Operation GhostMail", "key": "campaign:operation-ghostmail" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-66376", "key": "cve:cve-2025-66376" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "1035, Domain · medium confidence", "key": "metric:1035-domain-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "60 days · medium confidence", "key": "metric:60-days-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "60 seconds · medium confidence", "key": "metric:60-seconds-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "90 days · medium confidence", "key": "metric:90-days-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "analyticemailmeter[.]com", "key": "ioc:analyticemailmeter-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "buildandconsulting[.]com", "key": "ioc:buildandconsulting-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "istc-cloud[.]com", "key": "ioc:istc-cloud-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "mailnalysis[.]com", "key": "ioc:mailnalysis-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "pinmx[.]net", "key": "ioc:pinmx-.-net" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "proton[.]me", "key": "ioc:proton-.-me" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "zimbra-metadata[.]com", "key": "ioc:zimbra-metadata-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "zimbrastat[.]com", "key": "ioc:zimbrastat-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "zmailanalytics[.]com", "key": "ioc:zmailanalytics-.-com" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8", "key": "ioc:18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "1b25041ececf2457eef0270fc1d785cec8ec9ded", "key": "ioc:1b25041ececf2457eef0270fc1d785cec8ec9ded" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "2e4f314bc9943cab5005d6fde0b271c74d47bc9d", "key": "ioc:2e4f314bc9943cab5005d6fde0b271c74d47bc9d" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "50a87d926621dd06389ba50d86e0ff574ed713a8", "key": "ioc:50a87d926621dd06389ba50d86e0ff574ed713a8" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "62eb76432597694edb01c1fe57aab0cfe03a7178", "key": "ioc:62eb76432597694edb01c1fe57aab0cfe03a7178" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "8959c4d29e29f02ea94ea8bb21c8df2594c5549d", "key": "ioc:8959c4d29e29f02ea94ea8bb21c8df2594c5549d" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "b6b77c9a455225d525834a403ca9ef5481ed0447", "key": "ioc:b6b77c9a455225d525834a403ca9ef5481ed0447" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "c5a72420e7bb308d078e62128430897f82194c95", "key": "ioc:c5a72420e7bb308d078e62128430897f82194c95" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "cddf5c3be1e07f28140aed165b929bf2d614922a", "key": "ioc:cddf5c3be1e07f28140aed165b929bf2d614922a" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "e4fe6466a4f9a4249fe330651e914e45bbdca44a", "key": "ioc:e4fe6466a4f9a4249fe330651e914e45bbdca44a" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760", "key": "ioc:1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874", "key": "ioc:60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf", "key": "ioc:98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d", "key": "ioc:b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629", "key": "ioc:ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1027", "key": "mitre-attack-id:t1027" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1027.010", "key": "mitre-attack-id:t1027.010" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1027.013", "key": "mitre-attack-id:t1027.013" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1027.017", "key": "mitre-attack-id:t1027.017" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1048", "key": "mitre-attack-id:t1048" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1048.002", "key": "mitre-attack-id:t1048.002" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1048.003", "key": "mitre-attack-id:t1048.003" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1074", "key": "mitre-attack-id:t1074" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1074.002", "key": "mitre-attack-id:t1074.002" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1078", "key": "mitre-attack-id:t1078" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1087", "key": "mitre-attack-id:t1087" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1098", "key": "mitre-attack-id:t1098" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1114", "key": "mitre-attack-id:t1114" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1114.002", "key": "mitre-attack-id:t1114.002" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1119", "key": "mitre-attack-id:t1119" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1185", "key": "mitre-attack-id:t1185" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1199", "key": "mitre-attack-id:t1199" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1203", "key": "mitre-attack-id:t1203" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1550", "key": "mitre-attack-id:t1550" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1550.004", "key": "mitre-attack-id:t1550.004" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1556", "key": "mitre-attack-id:t1556" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1556.006", "key": "mitre-attack-id:t1556.006" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1557", "key": "mitre-attack-id:t1557" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1560", "key": "mitre-attack-id:t1560" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1566", "key": "mitre-attack-id:t1566" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1583", "key": "mitre-attack-id:t1583" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1583.003", "key": "mitre-attack-id:t1583.003" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1587", "key": "mitre-attack-id:t1587" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1587.001", "key": "mitre-attack-id:t1587.001" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1587.004", "key": "mitre-attack-id:t1587.004" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1588", "key": "mitre-attack-id:t1588" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1588.002", "key": "mitre-attack-id:t1588.002" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1588.007", "key": "mitre-attack-id:t1588.007" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1589", "key": "mitre-attack-id:t1589" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1589.001", "key": "mitre-attack-id:t1589.001" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1589.002", "key": "mitre-attack-id:t1589.002" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1593", "key": "mitre-attack-id:t1593" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1595", "key": "mitre-attack-id:t1595" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1596", "key": "mitre-attack-id:t1596" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1596.005", "key": "mitre-attack-id:t1596.005" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1597", "key": "mitre-attack-id:t1597" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1597.002", "key": "mitre-attack-id:t1597.002" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1608", "key": "mitre-attack-id:t1608" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "CISA", "key": "publisher:cisa" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "official advisory, fraud alert, or regional threat report", "key": "relevance-basis:official-advisory-fraud-alert-or-regional-threat-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Nonprofit / NGO", "key": "sector:nonprofit-/-ngo" }, { "facet": "Source type", "type": "source_type", "value": "government or law-enforcement publication", "key": "source-type:government-or-law-enforcement-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_incident", "key": "statistical-use:context-or-incident" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA488", "key": "threat-group-identifier:ta488" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Password spraying", "key": "ttp:password-spraying" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-103", "title": "SANS 2024 CTI Survey: Managing the Evolving Threat Landscape | SANS Institute", "description": "SANS Institute research publication on AI and cybersecurity. Indexed with Financial Services context.", "url": "https://www.sans.org/white-papers/2024-cti-survey-managing-evolving-threat-landscape", "publisher": "SANS Institute", "published_at": "2026-05-26", "inclusion": "context", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "background_ai_mention", "key": "ai-relevance:background-ai-mention" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "2024 Organizations · medium confidence", "key": "metric:2024-organizations-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "15 years · medium confidence", "key": "metric:15-years-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1% · medium confidence", "key": "metric:1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10% · medium confidence", "key": "metric:10-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "22% · medium confidence", "key": "metric:22-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "27% · medium confidence", "key": "metric:27-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3% · medium confidence", "key": "metric:3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "31% · medium confidence", "key": "metric:31-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "36% · medium confidence", "key": "metric:36-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "38% · medium confidence", "key": "metric:38-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "48% · medium confidence", "key": "metric:48-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "52% · medium confidence", "key": "metric:52-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "56% · medium confidence", "key": "metric:56-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "62% · medium confidence", "key": "metric:62-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "74% · medium confidence", "key": "metric:74-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "75% · medium confidence", "key": "metric:75-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "78% · medium confidence", "key": "metric:78-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "83% · medium confidence", "key": "metric:83-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "93% · medium confidence", "key": "metric:93-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Context only", "key": "inclusion:context-only" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "SANS Institute", "key": "publisher:sans-institute" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "sans.org", "key": "publisher-domain:sans.org" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "requires manual relevance review", "key": "relevance-basis:requires-manual-relevance-review" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "research publication", "key": "source-type:research-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "do_not_aggregate", "key": "statistical-use:do-not-aggregate" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:sans.org:1b293ce38bbb3e13", "title": "sans.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sans.org/cyber-security-courses/cloud-native-security-devsecops-automation", "publisher": "SANS", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sans.org", "key": "publisher-domain:sans.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:sans.org:037bf01c1e19946e", "title": "sans.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sans.org/cyber-security-courses/cloud-security-threat-detection", "publisher": "SANS", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sans.org", "key": "publisher-domain:sans.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:scworld.com:f7021c0bd8390262", "title": "SC Media — Novel C2 tool leveraged in latest MuddyWater attacks", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.scworld.com/brief/novel-c2-tool-leveraged-in-latest-muddywater-attacks", "publisher": "Scworld", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "scworld.com", "key": "publisher-domain:scworld.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-029", "title": "Scam operations: Online fraud networks", "description": "OpenAI operational CTI publication covering Identity fraud and impersonation, Obfuscation and evasion, and Translation and localization. Indexed with OpenAI context.", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-scam-operations/", "publisher": "OpenAI", "published_at": "2025-10-01", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "IOC · Md5", "type": "ioc", "value": "25a0f773cf5ad8f8324f2097f9a07ac2", "key": "ioc:25a0f773cf5ad8f8324f2097f9a07ac2" }, { "facet": "IOC · Md5", "type": "ioc", "value": "47a709ed076df4faf13594bbd8a3505b", "key": "ioc:47a709ed076df4faf13594bbd8a3505b" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "OpenAI", "key": "publisher:openai" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:sysdig.com:d851aee8be4e3c75", "title": "SCARLETEEL: Operation leveraging Terraform, Kubernetes, and AWS for data theft | Sysdig TRT", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sysdig.com/blog/cloud-breach-terraform-data-theft", "publisher": "Sysdig", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sysdig.com", "key": "publisher-domain:sysdig.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:shodan.io:23a9ade17c4aa878", "title": "Search ACTi Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=ACTi", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:60587db7788ef652", "title": "Search Android Root Bridges", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Android+Debug+Bridge%22+%22Device%22+port%3A5555", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:42094f393adfd337", "title": "Search Avigilon Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=title%3A%22Avigilon%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:00115efc27a07fdb", "title": "Search Blue Iris Webcams", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=title%3A%22blue+iris+remote+view%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:113c28c9f96fa7fd", "title": "Search Brother printers admin interface", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Location%3A+%2Fmain%2Fmain.html%22+debut", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:c5655f10b0cdb5a8", "title": "Search Canon printers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=Server%3A+CANON+HTTP+Server", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:a89517895ddef25c", "title": "Search Canon VB-M600 Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=title%3A%22Network+Camera+VB-M600%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:02285672a03a6296", "title": "Search Cisco Smart Install clients", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=smart+install+client+active", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:cf3a2f3304bd3c37", "title": "Search Citrix applications", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Citrix+Applications%3A%22+port%3A1604", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:5d207b64bf510241", "title": "Search compromised systems on port 4444", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A4444+system32", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:1274ca93795c08f3", "title": "Search default MongoDB instances", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=mongodb+port%3A27017", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:b517da4c3d816ad5", "title": "Search Docker private registries", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Docker-Distribution-Api-Version%3A+registry%22+%22200+OK%22+-gitlab", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:c151191ca7d29314", "title": "Search DVR CCTV Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=200+ok+dvr+port%3A%2281%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:e9e2eaf6ee44941f", "title": "Search Epson printers via HTTP", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Server%3A+EPSON-HTTP%22+%22200+OK%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:2d03723aae5e1fb0", "title": "Search exposed MongoDB Express interfaces", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Set-Cookie%3A+mongo-express%3D%22+%22200+OK%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:7a009e4ae0a48001", "title": "Search Filezilla FTP servers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=filezilla+port%3A%2221%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:82c1030450f7269e", "title": "Search for ‘Owned by’ in HTTP title", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http.title%3A%220wn3d+by%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:85528a798e58d4a6", "title": "Search for access controllers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22HID+VertX%22+port%3A4070", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:f303bac160d3693c", "title": "Search for additional compromised routers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=hacked-router-help-sos", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:1ced53a73cf75e2d", "title": "Search for BACnet devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A47808", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:703d25e4e5cfdb23", "title": "Search for Bitcoin ransomware with screenshots", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=bitcoin+has_screenshot%3Atrue", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:3012c96d19b517ab", "title": "Search for compromised FTP servers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=HACKED+FTP+server", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:39cef61deabeb121", "title": "Search for control panel access points", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http.title%3A%22control+panel%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:eb8e6cc146eb6f4c", "title": "Search for devices advertising default passwords", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=HACKED-ROUTER-HELP-SOS-HAD-DEFAULT-PASSWORD", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:8be1264cce518389", "title": "Search for devices in North Korea", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=net%3A175.45.176.0%2F22%2C210.52.109.0%2F24%2C77.94.35.0%2F24", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:8e9b5505153d29e9", "title": "Search for DICOM X-Ray machines", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22DICOM+Server+Response%22+port%3A104", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:458b5057dd6666f0", "title": "Search for DNP3 devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A20000+source+address", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:5efab158f24c6204", "title": "Search for EIG electricity meters", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Server%3A+EIG+Embedded+Web+Server%22+%22200+Document+follows%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:4487e1aed60ebae0", "title": "Search for electric vehicle chargers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Server%3A+gSOAP%2F2.8%22+%22Content-Length%3A+583%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:0c613e04de6ad604", "title": "Search for EtherNet/IP devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A44818", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:5bee6aa4d4348bf2", "title": "Search for gas station pump controllers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22in-tank+inventory%22+port%3A10001", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:37efd40d80f38e36", "title": "Search for general dashboard interfaces", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http.title%3A%22dashboard%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:9593d4681ce684fc", "title": "Search for GPS trackers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%5B1m%5B35mWelcome+on+console", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:7c77378dc6447542", "title": "Search for HACKED-ROUTER", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=HACKED-ROUTER", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:8f08b7f5738078e1", "title": "Search for IEC 60870–5–104 devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A2404+asdu+address", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:6ac333ad6004d1d4", "title": "Search for MELSEC-Q devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A5006%2C5007+product%3Amitsubishi", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:65fc031b6309a572", "title": "Search for Minecraft servers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Minecraft+Server%22+%22protocol+340%22+port%3A25565", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:7f6751976b2c0d15", "title": "Search for misconfigured WordPress installations", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http.html%3A%22*+The+wp-config.php+creation+script+uses+this+file%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:966384b14857bd75", "title": "Search for Modbus devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A502", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:5a6e7b214e522af9", "title": "Search for Niagara Fox devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A1911%2C4911+product%3ANiagara", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:6ee4988731830e46", "title": "Search for Nordex Control systems", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http.title%3A%22Nordex+Control%22+%22Windows+2000+5.0+x86%22+%22Jetty%2F3.1+%28JSP+1.1%3B+Servlet+2.2%3B+java+1.6.0_14%29%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:aecadb3094615f56", "title": "Search for Omron FINS devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A9600+response+code", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:7daf39bdfd425917", "title": "Search for PCWorx devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A1962+PLC", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:c198f9ba1678d233", "title": "Search for ProConOS devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A20547+PLC", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:e762e8070852bcfa", "title": "Search for ransomware-infected RDP services", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22attention%22+%22encrypted%22+port%3A3389", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:7bdd91344426c465", "title": "Search for Siemens industrial automation devices", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Siemens%2C+SIMATIC%22+port%3A161", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:1acc136eb70fd47c", "title": "Search for Siemens S7 controllers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A102", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:82ba9d47fb6e74eb", "title": "Search for Tesla-related interfaces", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http.title%3A%22Tesla%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:f2ccb6f753a91987", "title": "Search for variations of ‘Hacked by’ in title", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=hacked+by", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:0cb76632016bbddf", "title": "Search for VNC servers with disabled authentication", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22authentication+disabled%22+port%3A5900%2C5901", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:17e042635cafa995", "title": "Search for websites with ‘Hacked by’ in title", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http.title%3A%22Hacked+by%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:1632f483fa1ef21f", "title": "Search for XZERES Wind Turbines", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=title%3A%22xzeres+wind%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:616b1fc1c9c8f0f7", "title": "Search FTP servers allowing access without credentials", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22220%22+%22230+Login+successful.%22+port%3A21", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:4c628fd3559a1799", "title": "Search FTP with anonymous access", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Anonymous+access+allowed%22+port%3A%2221%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:c9667fcfc8d4b13e", "title": "Search general printers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=printer", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:faf746489bb4c0f4", "title": "Search GeoVision Webcams", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=server%3A+GeoHttpServer", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:ea3a4ac0110234d4", "title": "Search here", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=camera", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:a12013e0fed3195b", "title": "Search Hikvision Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=product%3A%22Hikvision+IP+Camera%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:8a785ad67752bda3", "title": "Search HP LaserJet printers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22HP-ChaiSOE%22+port%3A%2280%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:f075af3761daa047", "title": "Search HP printers with remote restart capability", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A161+hp", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:d11eb98d48c0b785", "title": "Search HTTP accessible Epson printers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http+200+server+epson+-upnp", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:3eb1da02a4588105", "title": "Search i-Catcher CCTV Systems", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=server%3A+%22i-Catcher+Console%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:d8111a4639efc5fd", "title": "Search IPCam Client", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=title%3A%22IPCam+Client%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:56936a9603065b69", "title": "Search Jenkins CI instances", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22X-Jenkins%22+%22Set-Cookie%3A+JSESSIONID%22+http.title%3A%22Dashboard%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:042badef9b1451a3", "title": "Search Lexmark printer control panels", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=Printer+Type%3A+Lexmark", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:d7201b3143487be1", "title": "Search Linksys WVC80N Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=WVC80N", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:cb41dcd411c2ea6a", "title": "Search listed Apache CouchDB", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=product%3A%22CouchDB%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:0b50ad706f7da146", "title": "Search Merit LILIN Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=WWW-Authenticate%3A+%22Merit+LILIN+Ent.+Co.%2C+Ltd.%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:5ef160fb26be9624", "title": "Search MongoDB server information", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22MongoDB+Server+Information%22+port%3A27017", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:0ca353b317e110f9", "title": "Search MySQL databases", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=product%3AMySQL", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:52534996bbeba92e", "title": "Search NDMP services on FTP port 10000", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=ftp+port%3A%2210000%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:368bbcf856a061e8", "title": "Search Netwave IP Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=Netwave+IP+Camera+Content-Length%3A+2574", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:6ef1dbd73478cde7", "title": "Search open Elasticsearch databases", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A%229200%22+all%3Aelastic", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:e0e4a9f5cf759cb5", "title": "Search open file lists", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http.title%3A%22Index+of+%2F%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:f64fc5945f5a72cb", "title": "Search open lists on port 80", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A80+title%3A%22Index+of+%2F%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:c1d5132346be3580", "title": "Search open Pi-hole DNS servers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22dnsmasq-pi-hole%22+%22Recursion%3A+enabled%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:6dcf590d674a88c5", "title": "Search PBX gateways", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=PBX+%22gateway+console%22+-password+port%3A23", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:041986c9087b25de", "title": "Search Polycom systems", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=http.title%3A%22-+Polycom%22+%22Server%3A+lighttpd%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:d07b90b9e4ab963e", "title": "Search PostgreSQL connections", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A5432+PostgreSQL", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:8fd6ff663675ef68", "title": "Search printers with FTP access", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=Laser+Printer+FTP+Server", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:0e2dfd1094fc67fc", "title": "Search printers with unsecured Telnet access", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A23+%22Password+is+not+set%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:4aad4175fa088376", "title": "Search QuickBooks files over network", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22QuickBooks+files+OverNetwork%22+-unix+port%3A445", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:60e44333ac2e9a6f", "title": "Search Samba shares with disabled authentication", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=%22Authentication%3A+disabled%22+port%3A445+product%3A%22Samba%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:ebdc98feeb1f713f", "title": "Search Samsung printers with SyncThru", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=title%3A%22syncthru+web+service%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:ed2e634ad43b964a", "title": "Search UI3 Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=title%3A%22ui3+-%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:126472b78c338ead", "title": "Search Unsecured Linksys Webcams", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=title%3A%22%2Btm01%2B%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:884e9ee66b426eb5", "title": "Search Vivotek Cameras", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=server%3A+VVTK-HTTP-Server", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:c8168f8d52c803a5", "title": "Search vulnerable CouchDB instances", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=port%3A%225984%22%2BServer%3A+%22CouchDB%2F2.1.0%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:185c0dfce7be0f31", "title": "Search vulnerable vsftpd servers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=vsftpd+2.3.4", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:963fd90dfe80fccf", "title": "Search webcam 7", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=server%3A+%22webcam+7%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:08b8375660f2d761", "title": "Search Webcams with Screenshots", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=webcam+has_screenshot%3Atrue", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:ba9f8a301c944875", "title": "Search webcamXP", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=server%3A+webcamxp", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:98ab59a19dab06d1", "title": "Search Xerox printers with remote access", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=ssl%3A%22Xerox+Generic+Root%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:shodan.io:fbec90e8b90e2a4c", "title": "Search Yawcam Webcams", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.shodan.io/search?query=product%3A%22Yawcam+webcam+viewer+httpd%22", "publisher": "Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "shodan.io", "key": "publisher-domain:shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:github.com:02cd5d697b5006f6", "title": "SecLists", "description": "External source cited by 4 maintained 1200km pages.", "url": "https://github.com/danielmiessler/SecLists", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering DirBuster: A Strategic Approach to Uncovering Hidden Web Assets", "url": "https://1200km.com/articles/read/2024/2024-11-10-mastering-dirbuster-a-strategic-approach-to-uncovering-hidden-web-assets-31c8406a892b/", "type": "article", "domain": "application-security" }, { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" }, { "title": "Web Applications Penetretion Testing. Stage 1: Reconnaissance", "url": "https://1200km.com/articles/read/2024/2024-11-10-web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399/", "type": "article", "domain": "application-security" }, { "title": "Web Applications Penetretion Testing. Stage 2: Scanning and Vulnerability Assessment", "url": "https://1200km.com/articles/read/2024/2024-11-13-web-applications-penetretion-testing-stage-2-scanning-and-vulnerability-assessment-15021e81c130/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:secureframe.com:d72c46ec5872d732", "title": "secureframe.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://secureframe.com/hub/iso-27001/controls", "publisher": "Secureframe", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "secureframe.com", "key": "publisher-domain:secureframe.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:securelist.com:07f48fbc5d138174", "title": "securelist.com/olympic-destroyer-is-here-to-trick-the-industry/84295", "description": "External source cited by 1 maintained 1200km page.", "url": "https://securelist.com/olympic-destroyer-is-here-to-trick-the-industry/84295", "publisher": "Securelist", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "securelist.com", "key": "publisher-domain:securelist.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Attribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution", "url": "https://1200km.com/articles/read/2026/2026-03-20-attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:securityaffairs.com:a9fc9afdf1ff9d17", "title": "Security Affairs — MuddyWater strikes Israel with advanced MuddyViper malware", "description": "External source cited by 1 maintained 1200km page.", "url": "https://securityaffairs.com/185244/apt/muddywater-strikes-israel-with-advanced-muddyviper-malware.html", "publisher": "Securityaffairs", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "securityaffairs.com", "key": "publisher-domain:securityaffairs.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:security-gen.com:8773b851cff8a23b", "title": "security-gen.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://security-gen.com/SecurityGen-whitepaper-gtp-firewall.pdf", "publisher": "Security GEN", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "security-gen.com", "key": "publisher-domain:security-gen.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:securityonline.info:fd28eeed693d71b3", "title": "securityonline.info", "description": "External source cited by 1 maintained 1200km page.", "url": "https://securityonline.info/fake-google-authenticator-ads-spread-malware-through-google-search", "publisher": "Securityonline", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "securityonline.info", "key": "publisher-domain:securityonline.info" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:sekoia.io:40ddd8484c45336a", "title": "Sekoia.io Intelligence", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sekoia.io", "publisher": "Sekoia", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sekoia.io", "key": "publisher-domain:sekoia.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:globalsecurity.org:010b1ea9d08266bb", "title": "Senate Select Committee conclusions via GlobalSecurity mirror", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.globalsecurity.org/intell/library/congress/2004_rpt/iraq-wmd_intell_09jul2004_conclusions.htm", "publisher": "Globalsecurity", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "globalsecurity.org", "key": "publisher-domain:globalsecurity.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:docs.aws.amazon.com:7acc47fd7b9d7051", "title": "Send control plane logs to CloudWatch Logs — Amazon EKS", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Sending EKS Control Plane Logs via AWS Lambda", "url": "https://1200km.com/articles/read/2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-069", "title": "Senior U.S. Officials Continue To Be Impersonated in Malicious Messaging Campaign | Federal Bureau of Investigation", "description": "FBI government or law-enforcement publication covering Deepfake voice, Identity fraud and impersonation, and Deepfake impersonation. Indexed with Cryptocurrency context.", "url": "https://www.fbi.gov/investigate/cyber/alerts/2025/senior-us-officials-continue-to-be-impersonated-in-malicious-messaging-campaign", "publisher": "FBI", "published_at": "2025-12-19", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Smishing", "key": "attack-vector:smishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "FBI", "key": "publisher:fbi" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "fbi.gov", "key": "publisher-domain:fbi.gov" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "official advisory, fraud alert, or regional threat report", "key": "relevance-basis:official-advisory-fraud-alert-or-regional-threat-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "government or law-enforcement publication", "key": "source-type:government-or-law-enforcement-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_incident", "key": "statistical-use:context-or-incident" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:sentinelone.com:b5b6f8928d4646a3", "title": "SentinelOne — Iranian Cyber Activity Outlook", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sentinelone.com/blog/sentinelone-intelligence-brief-iranian-cyber-activity-outlook", "publisher": "Sentinelone", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:sentinelone.com:245e1561c0bcd43c", "title": "SentinelOne — Wading Through Muddy Waters", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor", "publisher": "Sentinelone", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:sentinelone.com:7b003767f52b0281", "title": "SentinelOne AcidRain", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe", "publisher": "Sentinelone", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" }, { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:sentinelone.com:29f826a8a8cbfcd0", "title": "sentinelone.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sentinelone.com/blog/climbing-the-ladder-kubernetes-privilege-escalation-part-1", "publisher": "Sentinelone", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sentinelone.com", "key": "publisher-domain:sentinelone.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:oligo.security:f24010305bbaeea8", "title": "ShadowRay report", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild", "publisher": "Oligo", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "oligo.security", "key": "publisher-domain:oligo.security" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" }, { "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:help.shodan.io:66d83479f09c1136", "title": "Shodan Help Center", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://help.shodan.io", "publisher": "HELP Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "help.shodan.io", "key": "publisher-domain:help.shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:internetdb.shodan.io:2491181db7086675", "title": "Shodan InternetDB", "description": "External source cited by 1 maintained 1200km page.", "url": "https://internetdb.shodan.io", "publisher": "Internetdb Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "internetdb.shodan.io", "key": "publisher-domain:internetdb.shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:help.shodan.io:4e52753779b6406d", "title": "Shodan query fundamentals", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://help.shodan.io/the-basics/search-query-fundamentals", "publisher": "HELP Shodan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "help.shodan.io", "key": "publisher-domain:help.shodan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "type": "article", "domain": "threat-intelligence" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:arxiv.org:d334df2a2076adb3", "title": "Shokri et al. — Membership Inference Attacks Against Machine Learning Models", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1610.05820", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:sigmahq.io:6257efc5ec8fff09", "title": "Sigma Correlation Rules Specification | SigmaHQ", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sigmahq.io/sigma-specification/specification/sigma-correlation-rules-specification.html", "publisher": "Sigmahq", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sigmahq.io", "key": "publisher-domain:sigmahq.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:sigmahq.io:46d8e1725e039768", "title": "Sigma rule documentation", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://sigmahq.io/docs/basics/rules.html", "publisher": "Sigmahq", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sigmahq.io", "key": "publisher-domain:sigmahq.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Blue Team & Defensive Security", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "type": "guide", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:cloud.google.com:ac539df35138ece8", "title": "Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger |… *Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's…*cloud.google.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:f0581afc529fb033", "title": "Site source", "description": "External source cited by 124 maintained 1200km pages.", "url": "https://github.com/anpa1200/anpa1200.github.io/tree/main/ITDR", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "lab", "key": "used-by-type:lab" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "identity-security", "key": "used-by-topic:identity-security" } ], "used_in": [ { "title": "389 Directory Server", "url": "https://1200km.com/ITDR/docs/protocols/open-source-directories/389ds/", "type": "documentation", "domain": "identity-security" }, { "title": "Acl Abuse", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/acl-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "Active Directory — Overview", "url": "https://1200km.com/ITDR/docs/protocols/active-directory/ad-overview/", "type": "documentation", "domain": "identity-security" }, { "title": "Active Directory Certificate Services (ADCS)", "url": "https://1200km.com/ITDR/docs/protocols/active-directory/adcs/", "type": "documentation", "domain": "identity-security" }, { "title": "Active Directory Lab Setup", "url": "https://1200km.com/ITDR/docs/labs/lab-ad-setup/", "type": "lab", "domain": "identity-security" }, { "title": "Active Directory Trusts", "url": "https://1200km.com/ITDR/docs/protocols/active-directory/ad-trusts/", "type": "documentation", "domain": "identity-security" }, { "title": "AdminSDHolder Abuse", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/adminsdholder-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "AiTM Phishing (Adversary-in-the-Middle)", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/aitm-phishing/", "type": "documentation", "domain": "identity-security" }, { "title": "API Token Abuse", "url": "https://1200km.com/ITDR/docs/attacks/saas/api-token-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "AS-REP Roasting", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/asrep-roasting/", "type": "documentation", "domain": "identity-security" }, { "title": "Attack–Defense Simulation Framework", "url": "https://1200km.com/ITDR/docs/simulations/simulation-framework/", "type": "lab", "domain": "identity-security" }, { "title": "Auth0 (Okta Customer Identity Cloud)", "url": "https://1200km.com/ITDR/docs/protocols/cloud-idp/auth0/", "type": "documentation", "domain": "identity-security" }, { "title": "AWS Cognito", "url": "https://1200km.com/ITDR/docs/protocols/aws-iam/aws-cognito/", "type": "documentation", "domain": "identity-security" }, { "title": "AWS IAM — Overview", "url": "https://1200km.com/ITDR/docs/protocols/aws-iam/aws-iam-overview/", "type": "documentation", "domain": "identity-security" }, { "title": "AWS IAM Identity Center", "url": "https://1200km.com/ITDR/docs/protocols/aws-iam/iam-identity-center/", "type": "documentation", "domain": "identity-security" }, { "title": "AWS Security Token Service (STS)", "url": "https://1200km.com/ITDR/docs/protocols/aws-iam/aws-sts/", "type": "documentation", "domain": "identity-security" }, { "title": "Certificate Theft", "url": "https://1200km.com/ITDR/docs/attacks/adcs-certificates/certificate-theft/", "type": "documentation", "domain": "identity-security" }, { "title": "Conditional Access", "url": "https://1200km.com/ITDR/docs/protocols/entra-id/conditional-access/", "type": "documentation", "domain": "identity-security" }, { "title": "Conditional Access Bypass", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/conditional-access-bypass/", "type": "documentation", "domain": "identity-security" }, { "title": "Constrained Delegation Abuse", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/constrained-delegation/", "type": "documentation", "domain": "identity-security" }, { "title": "Credential Stuffing", "url": "https://1200km.com/ITDR/docs/attacks/cross-platform/credential-stuffing/", "type": "documentation", "domain": "identity-security" }, { "title": "DCShadow", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/dcshadow/", "type": "documentation", "domain": "identity-security" }, { "title": "Dcsync", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/dcsync/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Acl Abuse", "url": "https://1200km.com/ITDR/docs/detection/ad-attack-detection/detect-acl-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting ADCS / Certificate Attacks", "url": "https://1200km.com/ITDR/docs/detection/adcs-detection/detect-certificate-attacks/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Asrep Roasting", "url": "https://1200km.com/ITDR/docs/detection/ad-attack-detection/detect-asrep-roasting/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Dcsync", "url": "https://1200km.com/ITDR/docs/detection/ad-attack-detection/detect-dcsync/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Device Code Phishing", "url": "https://1200km.com/ITDR/docs/detection/cloud-attack-detection/detect-device-code-phishing/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Golden Saml", "url": "https://1200km.com/ITDR/docs/detection/cloud-attack-detection/detect-golden-saml/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Golden Ticket", "url": "https://1200km.com/ITDR/docs/detection/ad-attack-detection/detect-golden-ticket/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Kerberoasting", "url": "https://1200km.com/ITDR/docs/detection/ad-attack-detection/detect-kerberoasting/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Mfa Fatigue", "url": "https://1200km.com/ITDR/docs/detection/cloud-attack-detection/detect-mfa-fatigue/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Oauth Abuse", "url": "https://1200km.com/ITDR/docs/detection/cloud-attack-detection/detect-oauth-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Pass The Hash", "url": "https://1200km.com/ITDR/docs/detection/ad-attack-detection/detect-pass-the-hash/", "type": "documentation", "domain": "identity-security" }, { "title": "Detecting Pass The Ticket", "url": "https://1200km.com/ITDR/docs/detection/ad-attack-detection/detect-pass-the-ticket/", "type": "documentation", "domain": "identity-security" }, { "title": "Detection Framework", "url": "https://1200km.com/ITDR/docs/detection/detection-framework/", "type": "documentation", "domain": "identity-security" }, { "title": "Device Code Phishing", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/device-code-phishing/", "type": "documentation", "domain": "identity-security" }, { "title": "Duo Security (Cisco)", "url": "https://1200km.com/ITDR/docs/protocols/cloud-idp/duo-security/", "type": "documentation", "domain": "identity-security" }, { "title": "Entra Connect Sync (AD Connect)", "url": "https://1200km.com/ITDR/docs/protocols/entra-id/entra-connect-sync/", "type": "documentation", "domain": "identity-security" }, { "title": "Entra ID (Azure AD) — Overview", "url": "https://1200km.com/ITDR/docs/protocols/entra-id/entra-overview/", "type": "documentation", "domain": "identity-security" }, { "title": "Entra ID Identity Protection", "url": "https://1200km.com/ITDR/docs/protocols/entra-id/identity-protection/", "type": "documentation", "domain": "identity-security" }, { "title": "Entra ID Lab Setup", "url": "https://1200km.com/ITDR/docs/labs/lab-entra-setup/", "type": "lab", "domain": "identity-security" }, { "title": "ESC1 — Certificate Template Privilege Escalation", "url": "https://1200km.com/ITDR/docs/attacks/adcs-certificates/esc1-template-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "ESC4–ESC8 — CA-Level and ACL Attacks", "url": "https://1200km.com/ITDR/docs/attacks/adcs-certificates/esc4-esc8/", "type": "documentation", "domain": "identity-security" }, { "title": "FIDO2 & WebAuthn", "url": "https://1200km.com/ITDR/docs/protocols/pki-certificates/fido2-webauthn/", "type": "documentation", "domain": "identity-security" }, { "title": "FreeIPA", "url": "https://1200km.com/ITDR/docs/protocols/open-source-directories/freeipa/", "type": "documentation", "domain": "identity-security" }, { "title": "GitHub Identity Security", "url": "https://1200km.com/ITDR/docs/saas-platforms/github-identity/", "type": "documentation", "domain": "identity-security" }, { "title": "Golden SAML", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/golden-saml/", "type": "documentation", "domain": "identity-security" }, { "title": "Golden Ticket", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/golden-ticket/", "type": "documentation", "domain": "identity-security" }, { "title": "Google Cloud IAM", "url": "https://1200km.com/ITDR/docs/protocols/google-workspace/gcp-iam/", "type": "documentation", "domain": "identity-security" }, { "title": "Google Workspace — Overview", "url": "https://1200km.com/ITDR/docs/protocols/google-workspace/gws-overview/", "type": "documentation", "domain": "identity-security" }, { "title": "Google Workspace SAML & OIDC", "url": "https://1200km.com/ITDR/docs/protocols/google-workspace/gws-saml-oidc/", "type": "documentation", "domain": "identity-security" }, { "title": "Group Policy", "url": "https://1200km.com/ITDR/docs/protocols/active-directory/group-policy/", "type": "documentation", "domain": "identity-security" }, { "title": "Hybrid Attack Chains", "url": "https://1200km.com/ITDR/docs/attacks/cross-platform/hybrid-attack-chains/", "type": "documentation", "domain": "identity-security" }, { "title": "Identity as the New Perimeter", "url": "https://1200km.com/ITDR/docs/identity-foundations/identity-as-perimeter/", "type": "documentation", "domain": "identity-security" }, { "title": "Identity Attack Surface", "url": "https://1200km.com/ITDR/docs/identity-foundations/identity-attack-surface/", "type": "documentation", "domain": "identity-security" }, { "title": "Identity Frameworks & Standards", "url": "https://1200km.com/ITDR/docs/identity-foundations/identity-frameworks/", "type": "documentation", "domain": "identity-security" }, { "title": "Identity Governance & Administration (IGA)", "url": "https://1200km.com/ITDR/docs/iga/iga-overview/", "type": "documentation", "domain": "identity-security" }, { "title": "Illicit Consent Grant", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/illicit-consent-grant/", "type": "documentation", "domain": "identity-security" }, { "title": "ITDR", "url": "https://1200km.com/ITDR/", "type": "research", "domain": "identity-security" }, { "title": "ITDR — Identity Threat Detection & Response", "url": "https://1200km.com/ITDR/docs/intro/", "type": "documentation", "domain": "identity-security" }, { "title": "ITDR Professional Roadmap", "url": "https://1200km.com/ITDR/docs/roadmap/", "type": "documentation", "domain": "identity-security" }, { "title": "ITDR Vendor Landscape", "url": "https://1200km.com/ITDR/docs/itdr-vendors/itdr-vendor-landscape/", "type": "documentation", "domain": "identity-security" }, { "title": "JumpCloud", "url": "https://1200km.com/ITDR/docs/protocols/cloud-idp/jumpcloud/", "type": "documentation", "domain": "identity-security" }, { "title": "Kerberoasting", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/kerberoasting/", "type": "documentation", "domain": "identity-security" }, { "title": "Kerberos on Linux", "url": "https://1200km.com/ITDR/docs/protocols/linux-identity/linux-kerberos/", "type": "documentation", "domain": "identity-security" }, { "title": "Kerberos Protocol", "url": "https://1200km.com/ITDR/docs/protocols/active-directory/kerberos/", "type": "documentation", "domain": "identity-security" }, { "title": "Kubernetes RBAC", "url": "https://1200km.com/ITDR/docs/protocols/kubernetes/k8s-rbac/", "type": "documentation", "domain": "identity-security" }, { "title": "Kubernetes Service Accounts", "url": "https://1200km.com/ITDR/docs/protocols/kubernetes/k8s-service-accounts/", "type": "documentation", "domain": "identity-security" }, { "title": "Lab Architecture", "url": "https://1200km.com/ITDR/docs/labs/lab-architecture/", "type": "lab", "domain": "identity-security" }, { "title": "LDAP in Active Directory", "url": "https://1200km.com/ITDR/docs/protocols/active-directory/ldap/", "type": "documentation", "domain": "identity-security" }, { "title": "Linux Identity Lab Setup", "url": "https://1200km.com/ITDR/docs/labs/lab-linux-setup/", "type": "lab", "domain": "identity-security" }, { "title": "Linux PAM", "url": "https://1200km.com/ITDR/docs/protocols/linux-identity/linux-pam/", "type": "documentation", "domain": "identity-security" }, { "title": "Linux SSSD", "url": "https://1200km.com/ITDR/docs/protocols/linux-identity/linux-sssd/", "type": "documentation", "domain": "identity-security" }, { "title": "Linux sudo & Privilege", "url": "https://1200km.com/ITDR/docs/protocols/linux-identity/linux-sudo/", "type": "documentation", "domain": "identity-security" }, { "title": "Managed Identity Abuse", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/managed-identity-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "Mfa Bypass Techniques", "url": "https://1200km.com/ITDR/docs/attacks/cross-platform/mfa-bypass-techniques/", "type": "documentation", "domain": "identity-security" }, { "title": "Mfa Fatigue", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/mfa-fatigue/", "type": "documentation", "domain": "identity-security" }, { "title": "MFA Technologies", "url": "https://1200km.com/ITDR/docs/mfa/mfa-technologies/", "type": "documentation", "domain": "identity-security" }, { "title": "Microsoft 365 Identity", "url": "https://1200km.com/ITDR/docs/saas-platforms/m365-identity/", "type": "documentation", "domain": "identity-security" }, { "title": "NTLM Authentication", "url": "https://1200km.com/ITDR/docs/protocols/active-directory/ntlm/", "type": "documentation", "domain": "identity-security" }, { "title": "OAuth 2.0", "url": "https://1200km.com/ITDR/docs/protocols/entra-id/oauth2/", "type": "documentation", "domain": "identity-security" }, { "title": "OAuth App Abuse", "url": "https://1200km.com/ITDR/docs/attacks/saas/oauth-app-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "Oauth Token Theft", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/oauth-token-theft/", "type": "documentation", "domain": "identity-security" }, { "title": "Okta — Overview", "url": "https://1200km.com/ITDR/docs/protocols/okta/okta-overview/", "type": "documentation", "domain": "identity-security" }, { "title": "Okta Lab Setup", "url": "https://1200km.com/ITDR/docs/labs/lab-okta-setup/", "type": "lab", "domain": "identity-security" }, { "title": "Okta MFA", "url": "https://1200km.com/ITDR/docs/protocols/okta/okta-mfa/", "type": "documentation", "domain": "identity-security" }, { "title": "Okta Policies & Network Zones", "url": "https://1200km.com/ITDR/docs/protocols/okta/okta-policies/", "type": "documentation", "domain": "identity-security" }, { "title": "Okta SCIM Provisioning", "url": "https://1200km.com/ITDR/docs/protocols/okta/okta-scim/", "type": "documentation", "domain": "identity-security" }, { "title": "OneLogin", "url": "https://1200km.com/ITDR/docs/protocols/cloud-idp/onelogin/", "type": "documentation", "domain": "identity-security" }, { "title": "OpenID Connect (OIDC)", "url": "https://1200km.com/ITDR/docs/protocols/entra-id/oidc/", "type": "documentation", "domain": "identity-security" }, { "title": "OpenLDAP", "url": "https://1200km.com/ITDR/docs/protocols/open-source-directories/openldap/", "type": "documentation", "domain": "identity-security" }, { "title": "Pass The Prt", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/pass-the-prt/", "type": "documentation", "domain": "identity-security" }, { "title": "Pass The Ticket", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/pass-the-ticket/", "type": "documentation", "domain": "identity-security" }, { "title": "Pass-the-Hash (PtH)", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/pass-the-hash/", "type": "documentation", "domain": "identity-security" }, { "title": "Passkeys", "url": "https://1200km.com/ITDR/docs/protocols/pki-certificates/passkeys/", "type": "documentation", "domain": "identity-security" }, { "title": "Ping Identity", "url": "https://1200km.com/ITDR/docs/protocols/cloud-idp/ping-identity/", "type": "documentation", "domain": "identity-security" }, { "title": "PKI Overview", "url": "https://1200km.com/ITDR/docs/protocols/pki-certificates/pki-overview/", "type": "documentation", "domain": "identity-security" }, { "title": "Privileged Access Management (PAM)", "url": "https://1200km.com/ITDR/docs/pam/pam-overview/", "type": "documentation", "domain": "identity-security" }, { "title": "Privileged Identity Management (PIM)", "url": "https://1200km.com/ITDR/docs/protocols/entra-id/pim/", "type": "documentation", "domain": "identity-security" }, { "title": "RADIUS", "url": "https://1200km.com/ITDR/docs/protocols/network-auth/radius/", "type": "documentation", "domain": "identity-security" }, { "title": "Resource-Based Constrained Delegation (RBCD) Abuse", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/rbcd/", "type": "documentation", "domain": "identity-security" }, { "title": "SAML 2.0", "url": "https://1200km.com/ITDR/docs/protocols/entra-id/saml/", "type": "documentation", "domain": "identity-security" }, { "title": "Scenario: Certificate Escalation", "url": "https://1200km.com/ITDR/docs/simulations/scenarios/certificate-escalation/", "type": "lab", "domain": "identity-security" }, { "title": "Scenario: Cloud Identity Takeover", "url": "https://1200km.com/ITDR/docs/simulations/scenarios/cloud-identity-takeover/", "type": "lab", "domain": "identity-security" }, { "title": "Scenario: Domain Compromise Chain", "url": "https://1200km.com/ITDR/docs/simulations/scenarios/domain-compromise-chain/", "type": "lab", "domain": "identity-security" }, { "title": "Scenario: Hybrid Golden Saml", "url": "https://1200km.com/ITDR/docs/simulations/scenarios/hybrid-golden-saml/", "type": "lab", "domain": "identity-security" }, { "title": "SCIM Abuse", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/scim-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "Service Principal Abuse", "url": "https://1200km.com/ITDR/docs/attacks/entra-cloud/service-principal-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "Session Hijacking", "url": "https://1200km.com/ITDR/docs/attacks/saas/session-hijacking/", "type": "documentation", "domain": "identity-security" }, { "title": "Shadow Admin", "url": "https://1200km.com/ITDR/docs/attacks/saas/shadow-admin/", "type": "documentation", "domain": "identity-security" }, { "title": "Sid History Abuse", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/sid-history-abuse/", "type": "documentation", "domain": "identity-security" }, { "title": "Silver Ticket", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/silver-ticket/", "type": "documentation", "domain": "identity-security" }, { "title": "Skeleton Key", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/skeleton-key/", "type": "documentation", "domain": "identity-security" }, { "title": "Smart Cards & Hardware Tokens", "url": "https://1200km.com/ITDR/docs/protocols/pki-certificates/smart-cards/", "type": "documentation", "domain": "identity-security" }, { "title": "SPIFFE & SPIRE", "url": "https://1200km.com/ITDR/docs/protocols/kubernetes/spiffe-spire/", "type": "documentation", "domain": "identity-security" }, { "title": "SPNEGO & GSSAPI", "url": "https://1200km.com/ITDR/docs/protocols/active-directory/spnego-gssapi/", "type": "documentation", "domain": "identity-security" }, { "title": "TACACS+", "url": "https://1200km.com/ITDR/docs/protocols/network-auth/tacacs-plus/", "type": "documentation", "domain": "identity-security" }, { "title": "Unconstrained Delegation Abuse", "url": "https://1200km.com/ITDR/docs/attacks/active-directory/unconstrained-delegation/", "type": "documentation", "domain": "identity-security" }, { "title": "What is Identity?", "url": "https://1200km.com/ITDR/docs/identity-foundations/what-is-identity/", "type": "documentation", "domain": "identity-security" }, { "title": "What is ITDR?", "url": "https://1200km.com/ITDR/docs/identity-foundations/what-is-itdr/", "type": "documentation", "domain": "identity-security" }, { "title": "Workload Identity Federation", "url": "https://1200km.com/ITDR/docs/protocols/google-workspace/workload-identity-federation/", "type": "documentation", "domain": "identity-security" }, { "title": "WS-Federation", "url": "https://1200km.com/ITDR/docs/protocols/entra-id/ws-federation/", "type": "documentation", "domain": "identity-security" }, { "title": "X.509 Certificates", "url": "https://1200km.com/ITDR/docs/protocols/pki-certificates/x509-certificates/", "type": "documentation", "domain": "identity-security" } ] }, { "id": "site-reference:skylightcyber.com:54b6264bc1246207", "title": "Skylight Cyber — Cylance, I Kill You!", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://skylightcyber.com/2019/07/18/cylance-i-kill-you", "publisher": "Skylightcyber", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "skylightcyber.com", "key": "publisher-domain:skylightcyber.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:slsa.dev:c4032db171037f03", "title": "SLSA 1.2", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://slsa.dev/spec/v1.2", "publisher": "SLSA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "slsa.dev", "key": "publisher-domain:slsa.dev" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Secure Code & Application Security", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "type": "guide", "domain": "application-security" } ] }, { "id": "site-reference:sonicwall.com:a4908affb20bb167", "title": "SonicWall Cyber Threat Report 2024", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sonicwall.com/resources/white-paper/2024-sonicwall-cyber-threat-report", "publisher": "Sonicwall", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sonicwall.com", "key": "publisher-domain:sonicwall.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:bbc.com:73e22baf068e76ff", "title": "Source : Adobe Breach Impacted At Least 38 Million Users", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.bbc.com/news/technology-24740873", "publisher": "BBC", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "bbc.com", "key": "publisher-domain:bbc.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:scrubbed.net:eee91c5cc2c54f53", "title": "Source : LinkedIn Data Breach", "description": "External source cited by 1 maintained 1200km page.", "url": "https://scrubbed.net/blog/linkedin-data-leak-what-we-can-do-about-it", "publisher": "Scrubbed", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "scrubbed.net", "key": "publisher-domain:scrubbed.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:reuters.com:d6e40df0b13adcd7", "title": "Source : Yahoo’s 2013 Email Hack Actually Compromised Three Billion Accounts", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.reuters.com/article/technology/yahoo-says-all-three-billion-accounts-hacked-in-2013-data-theft-idUSKCN1C82NV", "publisher": "Reuters", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "reuters.com", "key": "publisher-domain:reuters.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:9d43a3134f100762", "title": "source-acquisition-report.md", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/blob/main/docs/source-gathering/source-acquisition-report.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:github.com:dc2036f6e2ce312b", "title": "source-reliability-evidence-assessment.md", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/blob/main/docs/source-gathering/source-reliability-evidence-assessment.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:sourceforge.net:a04454b10c8fb155", "title": "SourceForge+1aldeid.com+1", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sourceforge.net/projects/fakenet", "publisher": "Sourceforge", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sourceforge.net", "key": "publisher-domain:sourceforge.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:csrc.nist.gov:e58128431b1255c1", "title": "SP 800-207A", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://csrc.nist.gov/pubs/sp/800/207/a/final", "publisher": "CSRC NIST", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "csrc.nist.gov", "key": "publisher-domain:csrc.nist.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cloud Security", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "type": "guide", "domain": "cloud-security" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" } ] }, { "id": "site-reference:research.splunk.com:c99e7d8fe7b4c1f2", "title": "Splunk Security Content, Detection: Malicious PowerShell Process — Encoded Command (updated March 25, 2026)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://research.splunk.com/endpoint/c4db14d9-7909-48b4-a054-aa14d89dbb19", "publisher": "Research Splunk", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.splunk.com", "key": "publisher-domain:research.splunk.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:research.splunk.com:d294119da6483714", "title": "Splunk Security Content, Encoded Powershell attack data, including", "description": "External source cited by 1 maintained 1200km page.", "url": "https://research.splunk.com/attack_data/cc9b264d-efc9-11eb-926b-550bf0943fbb", "publisher": "Research Splunk", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.splunk.com", "key": "publisher-domain:research.splunk.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:spycloud.com:2032a7b587f93a3f", "title": "spycloud.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://spycloud.com/blog/top-takeaways-from-ibms-2023-data-breach-report", "publisher": "Spycloud", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "spycloud.com", "key": "publisher-domain:spycloud.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:raw.githubusercontent.com:7d392b4535def395", "title": "sql-audit/SERVER-RD-02-sql-audit.jsonl", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/sql-audit/SERVER-RD-02-sql-audit.jsonl", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:fortiguard.fortinet.com:95de3078647fbb8b", "title": "SSL-VPN symlink persistence advisory FG-IR-25–934 (CVE-2025–68686)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "publisher": "Fortiguard Fortinet", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "fortiguard.fortinet.com", "key": "publisher-domain:fortiguard.fortinet.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:cisa.gov:942b5bee3470409e", "title": "SSVC Decision Guide (CISA)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide.pdf", "publisher": "CISA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cisa.gov", "key": "publisher-domain:cisa.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "type": "article", "domain": "application-security" } ] }, { "id": "ai-attack-reference:pub-082", "title": "Staying ahead of threat actors in the age of AI", "description": "Microsoft provider or government report covering CAPTCHA bypass, Identity fraud and impersonation, and Malware development. Indexed with APT28 / Fancy Bear, Defense, and Microsoft context.", "url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/", "publisher": "Microsoft", "published_at": "2024-02-14", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-30190", "key": "cve:cve-2022-30190" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "29 countries · medium confidence", "key": "metric:29-countries-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "DeadLock ransomware", "key": "malware-or-tool:deadlock-ransomware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Microsoft", "key": "publisher:microsoft" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Nonprofit / NGO", "key": "sector:nonprofit-/-ngo" }, { "facet": "Sector", "type": "sector", "value": "Technology", "key": "sector:technology" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT43 / Kimsuky", "key": "threat-group:apt43-/-kimsuky" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT28", "key": "threat-group-identifier:apt28" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT4", "key": "threat-group-identifier:apt4" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" }, { "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:oasis-open.github.io:2b356879ea041f88", "title": "STIX / TAXII", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://oasis-open.github.io/cti-documentation", "publisher": "Oasis OPEN Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "oasis-open.github.io", "key": "publisher-domain:oasis-open.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:stixproject.github.io:c31ec9aa1b04edca", "title": "STIX Project — Relationships", "description": "External source cited by 1 maintained 1200km page.", "url": "https://stixproject.github.io/documentation/concepts/relationships", "publisher": "Stixproject Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "stixproject.github.io", "key": "publisher-domain:stixproject.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:arxiv.org:397f6d426ca2c86e", "title": "STIXnet — Extracting STIX Objects in CTI Reports", "description": "External source cited by 1 maintained 1200km page.", "url": "https://arxiv.org/abs/2303.09999", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:kubernetes.io:106d8b30d13105ed", "title": "Storage Classes in Kubernetes", "description": "External source cited by 1 maintained 1200km page.", "url": "https://kubernetes.io/docs/concepts/storage/storage-classes", "publisher": "Kubernetes", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "kubernetes.io", "key": "publisher-domain:kubernetes.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "ai-attack-reference:pub-030", "title": "STORM-0817: Iran-linked malware and scraping activity", "description": "OpenAI operational CTI publication covering Code debugging and scripting, Reconnaissance and target research, and Translation and localization. Indexed with SweetSpecter, Defense, and OpenAI context.", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-storm-0817/", "publisher": "OpenAI", "published_at": "2024-10-01", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Code debugging and scripting", "key": "ai-use-case:code-debugging-and-scripting" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "OpenAI", "key": "publisher:openai" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "openai.com", "key": "publisher-domain:openai.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Media", "key": "sector:media" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Threat group", "type": "threat_group", "value": "SweetSpecter", "key": "threat-group:sweetspecter" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "STORM-0817", "key": "threat-group-identifier:storm-0817" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "site-reference:strawberryperl.com:541c8ac0fcbba137", "title": "Strawberry Perl’s official site", "description": "External source cited by 1 maintained 1200km page.", "url": "https://strawberryperl.com", "publisher": "Strawberryperl", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "strawberryperl.com", "key": "publisher-domain:strawberryperl.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Nikto: Uncovering Web Server Vulnerabilities with an Open-Source Scanner", "url": "https://1200km.com/articles/read/2024/2024-11-12-nikto-uncovering-web-server-vulnerabilities-with-an-open-source-scanner-6d2d2fbc1e21/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:pypi.org:0cfbc0e30a66d103", "title": "String Analyzer on PyPI", "description": "External source cited by 1 maintained 1200km page.", "url": "https://pypi.org/project/string-analyzer", "publisher": "PYPI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "pypi.org", "key": "publisher-domain:pypi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Strings Analysis for Malware Analysis: Turning Binary Text into Defensible Hypotheses", "url": "https://1200km.com/articles/read/2026/2026-08-12-strings-analysis-for-malware-analysis-turning-391815ee35e2/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "ai-attack-reference:pub-087", "title": "SugarGh0st RAT Targets American AI Experts", "description": "Proofpoint operational CTI publication covering Command and control, Data exfiltration, and Spearphishing. Indexed with SweetSpecter, Artificial Intelligence, and Anthropic context.", "url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-artificial-sweetener-sugargh0st-rat-used-target-american", "publisher": "Proofpoint", "published_at": "2024-05-14", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "08 account · medium confidence", "key": "metric:08-account-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "10 individuals · medium confidence", "key": "metric:10-individuals-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "2024 campaign · medium confidence", "key": "metric:2024-campaign-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "gommask[.]online", "key": "ioc:gommask-.-online" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379", "key": "ioc:4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "71f5ce42714289658200739ce0bbe439f6ef6fe77a5f6757b1cf21200fc59af7", "key": "ioc:71f5ce42714289658200739ce0bbe439f6ef6fe77a5f6757b1cf21200fc59af7" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "da749785033087ca5d47ee65aef2818d4ed81ef217bfd4bc07be2d0bf105b1bf", "key": "ioc:da749785033087ca5d47ee65aef2818d4ed81ef217bfd4bc07be2d0bf105b1bf" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "fc779f02a40948568321d7f11b5432676e2be65f037acfed344b36cc3dac16fc", "key": "ioc:fc779f02a40948568321d7f11b5432676e2be65f037acfed344b36cc3dac16fc" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "feae7b2b79c533a522343ac9e1aa7f8a2cdf38691fbd333537cb15dd2ee9397e", "key": "ioc:feae7b2b79c533a522343ac9e1aa7f8a2cdf38691fbd333537cb15dd2ee9397e" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "SugarGh0st", "key": "malware-or-tool:sugargh0st" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "SugarGh0st RAT", "key": "malware-or-tool:sugargh0st-rat" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Proofpoint", "key": "publisher:proofpoint" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "proofpoint.com", "key": "publisher-domain:proofpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Artificial Intelligence", "key": "sector:artificial-intelligence" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Media", "key": "sector:media" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "AI researchers and experts", "key": "target:ai-researchers-and-experts" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "SweetSpecter", "key": "threat-group:sweetspecter" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "site-reference:nsarchive.gwu.edu:04b0fc97c09f73a3", "title": "Symantec, W32.Stuxnet Dossier archival mirror via National Security Archive", "description": "External source cited by 1 maintained 1200km page.", "url": "https://nsarchive.gwu.edu/document/21440-document-44", "publisher": "Nsarchive GWU", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "nsarchive.gwu.edu", "key": "publisher-domain:nsarchive.gwu.edu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:sysdig.com:e09eeaaa243564ea", "title": "Sysdig research: JADEPUFFER and cloud/runtime threats", "description": "External source cited by 1 maintained 1200km page.", "url": "https://sysdig.com/blog", "publisher": "Sysdig", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sysdig.com", "key": "publisher-domain:sysdig.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques", "url": "https://1200km.com/newest-detection-engineering-techniques/", "type": "mirror", "domain": "detection-engineering" } ] }, { "id": "site-reference:sysdig.com:18e9e1b1c3164fb4", "title": "sysdig.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sysdig.com/blog/teamtnt-aws-credentials", "publisher": "Sysdig", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sysdig.com", "key": "publisher-domain:sysdig.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:raw.githubusercontent.com:b3259e8907bf0e5b", "title": "sysmon/WS-CFO-01-sysmon.jsonl", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/sysmon/WS-CFO-01-sysmon.jsonl", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:gitlab.com:6cb16e194ed31b5e", "title": "System V x86-64 psABI project", "description": "External source cited by 1 maintained 1200km page.", "url": "https://gitlab.com/x86-psABIs/x86-64-ABI", "publisher": "Gitlab", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gitlab.com", "key": "publisher-domain:gitlab.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:arxiv.org:1fba85759cd59c6d", "title": "Szegedy et al. — Intriguing Properties of Neural Networks", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1312.6199", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "ai-attack-reference:pub-088", "title": "TA547 Targets German Organizations: Rhadamanthys Stealer", "description": "Proofpoint operational CTI publication covering Identity fraud and impersonation, Malware development, and Phishing and lure generation. Indexed with TA547, Financial Services, and Anthropic context.", "url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-organizations-rhadamanthys-stealer", "publisher": "Proofpoint", "published_at": "2024-04-03", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "bolibachan[.]com", "key": "ioc:bolibachan-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "indscpm[.]xyz", "key": "ioc:indscpm-.-xyz" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "metro-delivery[.]com", "key": "ioc:metro-delivery-.-com" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Lumma", "key": "malware-or-tool:lumma" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "NetSupport", "key": "malware-or-tool:netsupport" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "NetSupport RAT", "key": "malware-or-tool:netsupport-rat" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Rhadamanthys", "key": "malware-or-tool:rhadamanthys" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "StealC", "key": "malware-or-tool:stealc" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Proofpoint", "key": "publisher:proofpoint" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "proofpoint.com", "key": "publisher-domain:proofpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "TA547", "key": "threat-group:ta547" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "TA547", "key": "threat-group-identifier:ta547" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [] }, { "id": "site-reference:docs.fluentbit.io:e3b551ca9ec99cee", "title": "Tail | Fluent Bit: Official Manual *The Tail input plugin lets you monitor text files. Its behavior is similar to the tail -f shell command. The plugin…*docs.fluentbit.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.fluentbit.io/manual/pipeline/inputs/tail", "publisher": "DOCS Fluentbit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.fluentbit.io", "key": "publisher-domain:docs.fluentbit.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:blog.talosintelligence.com:ab0e089ddfc100b0", "title": "Talos ArcaneDoor", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices", "publisher": "BLOG Talosintelligence", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.talosintelligence.com", "key": "publisher-domain:blog.talosintelligence.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:blog.talosintelligence.com:1308b08fecffedd2", "title": "Talos FIRESTARTER analysis (April 2026)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.talosintelligence.com/uat-4356-firestarter", "publisher": "BLOG Talosintelligence", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.talosintelligence.com", "key": "publisher-domain:blog.talosintelligence.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:aquasec.com:285078bdd26ef73c", "title": "TeamTNT cloud campaign report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.aquasec.com/blog/teamtnt-reemerged-with-new-aggressive-cloud-campaign", "publisher": "Aquasec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aquasec.com", "key": "publisher-domain:aquasec.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:6528482c95b42190", "title": "TeamTNT cloud environment report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:sysdig.com:03e01156f6ec4b38", "title": "TeamTNT kubelet campaign report", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sysdig.com/blog/teamtnt-kubelet-credentials", "publisher": "Sysdig", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sysdig.com", "key": "publisher-domain:sysdig.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:techmonitor.ai:b237cc25293d9459", "title": "techmonitor.ai", "description": "External source cited by 1 maintained 1200km page.", "url": "https://techmonitor.ai/topic/gtp-protocol", "publisher": "Techmonitor", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "techmonitor.ai", "key": "publisher-domain:techmonitor.ai" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:technologymagazine.com:32c81e5fad5f947f", "title": "technologymagazine.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://technologymagazine.com/articles/mwc24-how-ericsson-solutions-are-securing-5g-networks", "publisher": "Technologymagazine", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "technologymagazine.com", "key": "publisher-domain:technologymagazine.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "site-governance", "key": "used-by-topic:site-governance" } ], "used_in": [ { "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "type": "article", "domain": "site-governance" } ] }, { "id": "site-reference:tetragon.io:937d396b7ff69a9d", "title": "Tetragon Documentation | tetragon.io", "description": "External source cited by 1 maintained 1200km page.", "url": "https://tetragon.io/docs", "publisher": "Tetragon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "tetragon.io", "key": "publisher-domain:tetragon.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-016", "title": "Text-to-Malware: How Cybercriminals Weaponize Fake AI-Themed Websites", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering Obfuscation and evasion, Reconnaissance and target research, and Command and control. Indexed with UNC6032 and Cryptocurrency context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites/", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2025-05-27", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Fake AI website", "key": "attack-vector:fake-ai-website" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Malicious advertisement", "key": "attack-vector:malicious-advertisement" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "European Union", "key": "country-or-region:european-union" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "adobe-express[.]com", "key": "ioc:adobe-express-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "ai-kling[.]com", "key": "ioc:ai-kling-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "aisoraplus[.]com", "key": "ioc:aisoraplus-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "api[.]telegram[.]org", "key": "ioc:api-.-telegram-.-org" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "artisanaqua[.]ddnsking[.]com", "key": "ioc:artisanaqua-.-ddnsking-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "boostcreatives-ai[.]com", "key": "ioc:boostcreatives-ai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "canva-dreamlab[.]com", "key": "ioc:canva-dreamlab-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "canvadream-lab[.]com", "key": "ioc:canvadream-lab-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "canvadreamlab[.]com", "key": "ioc:canvadreamlab-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "canvaproai[.]com", "key": "ioc:canvaproai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "capcutproai[.]com", "key": "ioc:capcutproai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "creativepro-ai[.]com", "key": "ioc:creativepro-ai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "creativespro-ai[.]com", "key": "ioc:creativespro-ai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "dreamai-luma[.]com", "key": "ioc:dreamai-luma-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "github[.]com", "key": "ioc:github-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "klings-ai[.]com", "key": "ioc:klings-ai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "klingxai[.]com", "key": "ioc:klingxai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "luma-aidream[.]com", "key": "ioc:luma-aidream-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "luma-dream[.]com", "key": "ioc:luma-dream-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "luma-dreamai[.]com", "key": "ioc:luma-dreamai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "luma-dreammachine[.]com", "key": "ioc:luma-dreammachine-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "lumaai-dream[.]com", "key": "ioc:lumaai-dream-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "lumaai-lab[.]com", "key": "ioc:lumaai-lab-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "lumaai-labs[.]com", "key": "ioc:lumaai-labs-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "lumaaidream[.]com", "key": "ioc:lumaaidream-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "lumaailabs[.]com", "key": "ioc:lumaailabs-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "quirkquestai[.]com", "key": "ioc:quirkquestai-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "strokes[.]zapto[.]org", "key": "ioc:strokes-.-zapto-.-org" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "zapto[.]org", "key": "ioc:zapto-.-org" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "1a037da4103e38ff95cb0008a5e38fd6a8e7df5bc8e2d44e496b7a5909ddebeb", "key": "ioc:1a037da4103e38ff95cb0008a5e38fd6a8e7df5bc8e2d44e496b7a5909ddebeb" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "4982a33e0c2858980126b8279191cb4eddd0a35f936cf3eda079526ba7c76959", "key": "ioc:4982a33e0c2858980126b8279191cb4eddd0a35f936cf3eda079526ba7c76959" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "839260ac321a44da55d4e6a5130c12869066af712f71c558bd42edd56074265b", "key": "ioc:839260ac321a44da55d4e6a5130c12869066af712f71c558bd42edd56074265b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "8863065544df546920ce6189dd3f99ab3f5d644d3d9c440667c1476174ba862b", "key": "ioc:8863065544df546920ce6189dd3f99ab3f5d644d3d9c440667c1476174ba862b" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "8d2c9c2b5af31e0e74185a82a816d3d019a0470a7ad8f5c1b40611aa1fd275cc", "key": "ioc:8d2c9c2b5af31e0e74185a82a816d3d019a0470a7ad8f5c1b40611aa1fd275cc" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "a0e75bd0b0fa0174566029d0e50875534c2fcc5ba982bd539bdeff506cae32d3", "key": "ioc:a0e75bd0b0fa0174566029d0e50875534c2fcc5ba982bd539bdeff506cae32d3" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "d3f50dc61d8c2be665a2d3933e2668448edc31546fea84517f8e61237c6d2e5d", "key": "ioc:d3f50dc61d8c2be665a2d3933e2668448edc31546fea84517f8e61237c6d2e5d" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "dcb1e9c6b066c2169928ae64e82343a250261f198eb5d091fd7928b69ed135d3", "key": "ioc:dcb1e9c6b066c2169928ae64e82343a250261f198eb5d091fd7928b69ed135d3" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "e663c1ba289d890a74e33c7e99f872c9a7b63e385a6a4af10a856d5226c9a822", "key": "ioc:e663c1ba289d890a74e33c7e99f872c9a7b63e385a6a4af10a856d5226c9a822" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "STARKVEIL malware", "key": "malware-or-tool:starkveil-malware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Threat group", "type": "threat_group", "value": "UNC6032", "key": "threat-group:unc6032" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6032", "key": "threat-group-identifier:unc6032" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malicious advertising", "key": "ttp:malicious-advertising" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:github.com:94bbf2adb7b2f149", "title": "THC-Hydra", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/vanhauser-thc/thc-hydra", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Hydra: The Ultimate Guide to Network Logon Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-01-mastering-hydra-the-ultimate-guide-to-network-logon-cracking-182579dbaed1/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-076", "title": "The adversary didn’t wait. Neither should you. | IBM", "description": "IBM X-Force threat-research report covering Reconnaissance and target research, Vulnerability research, and Spearphishing.", "url": "https://www.ibm.com/think/x-force/adversary-didnt-wait-neither-should-you", "publisher": "IBM X-Force", "published_at": "2026-04-30", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "56% · medium confidence", "key": "metric:56-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "IBM X-Force", "key": "publisher:ibm-x-force" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "ibm.com", "key": "publisher-domain:ibm.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Security researchers", "key": "target:security-researchers" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:github.com:837a4290add69a31", "title": "The Amass tutorial can be found here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/owasp-amass/amass/blob/master/doc/tutorial.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "OWASP Amass Project guide", "url": "https://1200km.com/articles/read/2024/2024-11-06-owasp-amass-project-guide-94bd55521f91/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:lockheedmartin.com:9a1219de9276368f", "title": "The Cyber Kill Chain (Lockheed Martin, 2011)", "description": "External source cited by 5 maintained 1200km pages.", "url": "https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html", "publisher": "Lockheedmartin", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "lockheedmartin.com", "key": "publisher-domain:lockheedmartin.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-hunting", "key": "used-by-topic:threat-hunting" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "type": "article", "domain": "threat-hunting" }, { "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" }, { "title": "Customer-Driven AI CTI Project Template :Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "type": "article", "domain": "detection-engineering" }, { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-011", "title": "The dawn of agentic AI in security operations at RSAC 2025", "description": "Google Threat Intelligence Group / Mandiant research publication covering Agentic AI and Large language model. Indexed with Financial Services and Google context.", "url": "https://cloud.google.com/blog/products/identity-security/the-dawn-of-agentic-ai-in-security-operations-at-rsac-2025", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2025-04-28", "inclusion": "context", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "adjacent_ai_security", "key": "ai-relevance:adjacent-ai-security" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "30 minutes · medium confidence", "key": "metric:30-minutes-medium-confidence" }, { "facet": "Inclusion", "type": "inclusion", "value": "Context only", "key": "inclusion:context-only" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "requires manual relevance review", "key": "relevance-basis:requires-manual-relevance-review" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "research publication", "key": "source-type:research-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "do_not_aggregate", "key": "statistical-use:do-not-aggregate" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-045", "title": "The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software", "description": "Palo Alto Networks Unit 42 operational CTI publication covering Autonomous or agentic intrusion, CAPTCHA bypass, and Exploit development. Indexed with Anthropic context.", "url": "https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/", "publisher": "Palo Alto Networks Unit 42", "published_at": "2026-08-04", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Autonomous or agentic intrusion", "key": "ai-use-case:autonomous-or-agentic-intrusion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-40947", "key": "cve:cve-2025-40947" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-40948", "key": "cve:cve-2025-40948" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-0257", "key": "cve:cve-2026-0257" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "55 days · medium confidence", "key": "metric:55-days-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "8 weeks · medium confidence", "key": "metric:8-weeks-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "28.6% · medium confidence", "key": "metric:28.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "39.7% · medium confidence", "key": "metric:39.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4.0% · medium confidence", "key": "metric:4.0-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "40% · medium confidence", "key": "metric:40-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8.0% · medium confidence", "key": "metric:8.0-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "92% · medium confidence", "key": "metric:92-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "99.4% · medium confidence", "key": "metric:99.4-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Palo Alto Networks Unit 42", "key": "publisher:palo-alto-networks-unit-42" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Vulnerability scanning", "key": "ttp:vulnerability-scanning" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:thehackernews.com:6887c66b50500181", "title": "The Hacker News — Iran-Linked MuddyWater Deploys Atera for Surveillance in Phishing Attacks", "description": "External source cited by 1 maintained 1200km page.", "url": "https://thehackernews.com/2024/03/iran-linked-muddywater-deploys-atera.html", "publisher": "Thehackernews", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "thehackernews.com", "key": "publisher-domain:thehackernews.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:thehackernews.com:145d1884f7e5587d", "title": "The Hacker News — MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP", "description": "External source cited by 1 maintained 1200km page.", "url": "https://thehackernews.com/2026/02/muddywater-targets-mena-organizations.html", "publisher": "Thehackernews", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "thehackernews.com", "key": "publisher-domain:thehackernews.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:thehackernews.com:1c07d8a6e6a90e1d", "title": "The Hacker News — MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack", "description": "External source cited by 1 maintained 1200km page.", "url": "https://thehackernews.com/2026/05/muddywater-uses-microsoft-teams-to.html", "publisher": "Thehackernews", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "thehackernews.com", "key": "publisher-domain:thehackernews.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:medium.com:eb5685140fc4b233", "title": "The Intelligent Shield. OpenCTI", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/the-intelligent-shield-057c9b4b9394", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-085", "title": "The near-term impact of AI on the cyber threat | National Cyber Security Centre", "description": "UK Government provider or government report covering Exploit development, Malware development, and Obfuscation and evasion. Indexed with Education context.", "url": "https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat", "publisher": "UK Government", "published_at": "2024-01-24", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "UK Government", "key": "publisher:uk-government" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "ncsc.gov.uk", "key": "publisher-domain:ncsc.gov.uk" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" }, { "facet": "Year", "type": "year", "value": "2024", "key": "year:2024" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-047", "title": "The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time", "description": "Palo Alto Networks Unit 42 operational CTI publication covering CAPTCHA bypass, Identity fraud and impersonation, and Malware development. Indexed with APT28 / Fancy Bear, Cryptocurrency, and Anthropic context.", "url": "https://unit42.paloaltonetworks.com/real-time-malicious-javascript-through-llms/", "publisher": "Palo Alto Networks Unit 42", "published_at": "2026-01-22", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "36% · medium confidence", "key": "metric:36-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Cloud", "key": "infrastructure:cloud" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "DeepSeek", "key": "llm-model:deepseek" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "DeepSeek", "key": "llm-provider:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "LAMEHUG", "key": "malware-or-tool:lamehug" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Palo Alto Networks Unit 42", "key": "publisher:palo-alto-networks-unit-42" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "APT28 / Fancy Bear", "key": "threat-group:apt28-/-fancy-bear" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT28", "key": "threat-group-identifier:apt28" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Script generation", "key": "ttp:script-generation" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-094", "title": "The Q3 2025 Threat Landscape Report", "description": "Rapid7 threat-research report covering Deepfake video or image, Deepfake voice, and Identity fraud and impersonation. Indexed with Akira and Critical Infrastructure context.", "url": "https://www.rapid7.com/research/report/threat-landscape-report-2025-q3/", "publisher": "Rapid7", "published_at": "2025-11-12", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Disruption / destruction", "key": "actor-motivation:disruption-/-destruction" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Companion source", "type": "source_lineage", "value": "src-093", "key": "source-lineage:src-093" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "CVE", "type": "cve", "value": "CVE-2007-0671", "key": "cve:cve-2007-0671" }, { "facet": "CVE", "type": "cve", "value": "CVE-2018-0296", "key": "cve:cve-2018-0296" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-10035", "key": "cve:cve-2025-10035" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-20333", "key": "cve:cve-2025-20333" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-20362", "key": "cve:cve-2025-20362" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-20363", "key": "cve:cve-2025-20363" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-49704", "key": "cve:cve-2025-49704" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-49706", "key": "cve:cve-2025-49706" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-53770", "key": "cve:cve-2025-53770" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-53771", "key": "cve:cve-2025-53771" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-54309", "key": "cve:cve-2025-54309" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-7775", "key": "cve:cve-2025-7775" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-18577", "key": "cve:cve-2026-18577" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-19490", "key": "cve:cve-2026-19490" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-63077", "key": "cve:cve-2026-63077" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-63520", "key": "cve:cve-2026-63520" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Cryptocurrency keys or seed phrases", "key": "data-type:cryptocurrency-keys-or-seed-phrases" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Duplicate lineage", "type": "duplicate_group", "value": "dup-005", "key": "duplicate-group:dup-005" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Controlled study", "key": "evidence-landscape:controlled-study" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "18 years · medium confidence", "key": "metric:18-years-medium-confidence" }, { "facet": "Extracted metric · Dwell Time", "type": "metric", "value": "12 months · medium confidence", "key": "metric:12-months-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "13% · medium confidence", "key": "metric:13-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "15% · medium confidence", "key": "metric:15-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "18% · medium confidence", "key": "metric:18-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3% · medium confidence", "key": "metric:3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4% · medium confidence", "key": "metric:4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5% · medium confidence", "key": "metric:5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6% · medium confidence", "key": "metric:6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "67% · medium confidence", "key": "metric:67-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "BRICKSTORM backdoor", "key": "malware-or-tool:brickstorm-backdoor" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "FunkSec", "key": "malware-or-tool:funksec" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "LAMEHUG", "key": "malware-or-tool:lamehug" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1003", "key": "mitre-attack-id:t1003" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1018", "key": "mitre-attack-id:t1018" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1021", "key": "mitre-attack-id:t1021" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1047", "key": "mitre-attack-id:t1047" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1059", "key": "mitre-attack-id:t1059" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1078", "key": "mitre-attack-id:t1078" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1087", "key": "mitre-attack-id:t1087" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1133", "key": "mitre-attack-id:t1133" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1560", "key": "mitre-attack-id:t1560" }, { "facet": "MITRE ATT&CK ID", "type": "mitre_attack_id", "value": "T1566", "key": "mitre-attack-id:t1566" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Rapid7", "key": "publisher:rapid7" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "rapid7.com", "key": "publisher-domain:rapid7.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Defense", "key": "sector:defense" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Healthcare", "key": "sector:healthcare" }, { "facet": "Sector", "type": "sector", "value": "Legal Services", "key": "sector:legal-services" }, { "facet": "Sector", "type": "sector", "value": "Technology", "key": "sector:technology" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Threat group", "type": "threat_group", "value": "Akira", "key": "threat-group:akira" }, { "facet": "Threat group", "type": "threat_group", "value": "APT29 / Cozy Bear", "key": "threat-group:apt29-/-cozy-bear" }, { "facet": "Threat group", "type": "threat_group", "value": "APT41", "key": "threat-group:apt41" }, { "facet": "Threat group", "type": "threat_group", "value": "APT43 / Kimsuky", "key": "threat-group:apt43-/-kimsuky" }, { "facet": "Threat group", "type": "threat_group", "value": "APT44 / Sandworm", "key": "threat-group:apt44-/-sandworm" }, { "facet": "Threat group", "type": "threat_group", "value": "Black Basta", "key": "threat-group:black-basta" }, { "facet": "Threat group", "type": "threat_group", "value": "Famous Chollima", "key": "threat-group:famous-chollima" }, { "facet": "Threat group", "type": "threat_group", "value": "FunkSec", "key": "threat-group:funksec" }, { "facet": "Threat group", "type": "threat_group", "value": "Lazarus Group", "key": "threat-group:lazarus-group" }, { "facet": "Threat group", "type": "threat_group", "value": "RansomHub", "key": "threat-group:ransomhub" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT29", "key": "threat-group-identifier:apt29" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT41", "key": "threat-group-identifier:apt41" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "STORM-1175", "key": "threat-group-identifier:storm-1175" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC5221", "key": "threat-group-identifier:unc5221" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Ransomware deployment", "key": "ttp:ransomware-deployment" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-107", "title": "The Sophos Annual Threat Report: Cybercrime on Main Street 2025", "description": "Sophos threat-research report covering Obfuscation and evasion, Business email compromise, and Command and control. Indexed with Akira, Cryptocurrency, and OpenAI context.", "url": "https://www.sophos.com/en-us/blog/the-sophos-annual-threat-report-cybercrime-on-main-street-2025", "publisher": "Sophos", "published_at": "2025-04-16", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Malicious advertisement", "key": "attack-vector:malicious-advertisement" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-34473", "key": "cve:cve-2021-34473" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-27532", "key": "cve:cve-2023-27532" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-3519", "key": "cve:cve-2023-3519" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-48788", "key": "cve:cve-2023-48788" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-4966", "key": "cve:cve-2023-4966" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-1709", "key": "cve:cve-2024-1709" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-21762", "key": "cve:cve-2024-21762" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-27198", "key": "cve:cve-2024-27198" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-3400", "key": "cve:cve-2024-3400" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-37085", "key": "cve:cve-2024-37085" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-4071", "key": "cve:cve-2024-4071" }, { "facet": "CVE", "type": "cve", "value": "CVE-2024-40711", "key": "cve:cve-2024-40711" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Threat landscape report", "key": "evidence-landscape:threat-landscape-report" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "365 account · medium confidence", "key": "metric:365-account-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$375. · medium confidence", "key": "metric:375.-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "0.21% · medium confidence", "key": "metric:0.21-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "0.43% · medium confidence", "key": "metric:0.43-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "0.64% · medium confidence", "key": "metric:0.64-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "0.85% · medium confidence", "key": "metric:0.85-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.28% · medium confidence", "key": "metric:1.28-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "14.53% · medium confidence", "key": "metric:14.53-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.35% · medium confidence", "key": "metric:2.35-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.78% · medium confidence", "key": "metric:2.78-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4.70% · medium confidence", "key": "metric:4.70-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Cobalt Strike", "key": "malware-or-tool:cobalt-strike" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "DanaBot", "key": "malware-or-tool:danabot" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Lumma", "key": "malware-or-tool:lumma" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Mimikatz", "key": "malware-or-tool:mimikatz" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "RansomHub ransomware", "key": "malware-or-tool:ransomhub-ransomware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "SystemBC malware", "key": "malware-or-tool:systembc-malware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Sophos", "key": "publisher:sophos" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "sophos.com", "key": "publisher-domain:sophos.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Jina Reader Proxy", "key": "retrieval-method:jina-reader-proxy" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "Akira", "key": "threat-group:akira" }, { "facet": "Threat group", "type": "threat_group", "value": "RansomHub", "key": "threat-group:ransomhub" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Malicious advertising", "key": "ttp:malicious-advertising" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-034", "title": "The State of AI in Cyber Security - Check Point Research", "description": "Check Point provider or government report covering Deepfake video or image, Deepfake voice, and Exploit development. Indexed with DeepSeek context.", "url": "https://research.checkpoint.com/2025/sate-of-ai-in-cyber-security/", "publisher": "Check Point", "published_at": "2025-04-30", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Exploit development", "key": "ai-use-case:exploit-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Taiwan", "key": "country-or-region:taiwan" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Financial and payment data", "key": "data-type:financial-and-payment-data" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.25% · medium confidence", "key": "metric:1.25-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11% · medium confidence", "key": "metric:11-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "18% · medium confidence", "key": "metric:18-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "21% · medium confidence", "key": "metric:21-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "25% · medium confidence", "key": "metric:25-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "27% · medium confidence", "key": "metric:27-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "33% · medium confidence", "key": "metric:33-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "37% · medium confidence", "key": "metric:37-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "51% · medium confidence", "key": "metric:51-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "7.5% · medium confidence", "key": "metric:7.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8% · medium confidence", "key": "metric:8-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Financial fraud", "key": "impact:financial-fraud" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "fia-gov[.]net", "key": "ioc:fia-gov-.-net" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "militarytc[.]com", "key": "ioc:militarytc-.-com" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "DeepSeek", "key": "llm-model:deepseek" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM provider", "type": "llm_provider", "value": "DeepSeek", "key": "llm-provider:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Hugging Face", "key": "llm-provider:hugging-face" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Check Point", "key": "publisher:check-point" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "research.checkpoint.com", "key": "publisher-domain:research.checkpoint.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Exploit development", "key": "ttp:exploit-development" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Ransomware deployment", "key": "ttp:ransomware-deployment" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-042", "title": "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution", "description": "Palo Alto Networks Unit 42 operational CTI publication covering CAPTCHA bypass, Identity fraud and impersonation, and Malware development. Indexed with FunkSec, Artificial Intelligence, and Anthropic context.", "url": "https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/", "publisher": "Palo Alto Networks Unit 42", "published_at": "2026-08-25", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "1062 Targets · medium confidence", "key": "metric:1062-targets-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "12 samples · medium confidence", "key": "metric:12-samples-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "405 samples · medium confidence", "key": "metric:405-samples-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "more than 50 organizations · medium confidence", "key": "metric:more-than-50-organizations-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "over 6,500 endpoint · medium confidence", "key": "metric:over-6-500-endpoint-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "100% · medium confidence", "key": "metric:100-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.0% · medium confidence", "key": "metric:3.0-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3% · medium confidence", "key": "metric:3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4% · medium confidence", "key": "metric:4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "97% · medium confidence", "key": "metric:97-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7", "key": "ioc:1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d", "key": "ioc:20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14", "key": "ioc:4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd", "key": "ioc:5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd", "key": "ioc:66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb", "key": "ioc:b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7", "key": "ioc:bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c", "key": "ioc:c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef", "key": "ioc:c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac", "key": "ioc:dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966", "key": "ioc:dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22", "key": "ioc:e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "FunkSec", "key": "malware-or-tool:funksec" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "FunkSec ransomware", "key": "malware-or-tool:funksec-ransomware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "JavaScript backdoor", "key": "malware-or-tool:javascript-backdoor" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Rhadamanthys", "key": "malware-or-tool:rhadamanthys" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "TuxBot", "key": "malware-or-tool:tuxbot" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Palo Alto Networks Unit 42", "key": "publisher:palo-alto-networks-unit-42" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Artificial Intelligence", "key": "sector:artificial-intelligence" }, { "facet": "Sector", "type": "sector", "value": "Critical Infrastructure", "key": "sector:critical-infrastructure" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "FunkSec", "key": "threat-group:funksec" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Target research / OSINT", "key": "ttp:target-research-/-osint" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:github.com:57a9b9fbabc532b6", "title": "The user’s guide can be found here:", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/owasp-amass/amass/blob/master/doc/user_guide.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "OWASP Amass Project guide", "url": "https://1200km.com/articles/read/2024/2024-11-06-owasp-amass-project-guide-94bd55521f91/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:thehackernews.com:8bb111f240fe2a16", "title": "thehackernews.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://thehackernews.com/2021/06/researchers-discover-first-known.html", "publisher": "Thehackernews", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "thehackernews.com", "key": "publisher-domain:thehackernews.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:thehackernews.com:082d699aa9bb4aa6", "title": "thehackernews.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://thehackernews.com/2025/08/researchers-spot-xz-utils-backdoor-in.html", "publisher": "Thehackernews", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "thehackernews.com", "key": "publisher-domain:thehackernews.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-020", "title": "Threat Actors are Interested in Generative AI, but Use Remains Limited", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering Deepfake video or image, Deepfake voice, and Identity fraud and impersonation. Indexed with APT43 / Kimsuky, Financial Services, and OpenAI context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-generative-ai-limited", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2023-08-17", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Hacktivism", "key": "actor-motivation:hacktivism" }, { "facet": "Actor motivation", "type": "actor_motivation", "value": "Influence / information operations", "key": "actor-motivation:influence-/-information-operations" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Influence operations", "key": "ai-use-case:influence-operations" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Business email compromise", "key": "attack-vector:business-email-compromise" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Israel", "key": "country-or-region:israel" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Country or region", "type": "country_or_region", "value": "Ukraine", "key": "country-or-region:ukraine" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "Malicious AI tool", "type": "malicious_ai_tool", "value": "WormGPT", "key": "malicious-ai-tool:wormgpt" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Cobalt Strike", "key": "malware-or-tool:cobalt-strike" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Media", "key": "sector:media" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Security researchers", "key": "target:security-researchers" }, { "facet": "Threat group", "type": "threat_group", "value": "APT43 / Kimsuky", "key": "threat-group:apt43-/-kimsuky" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "APT43", "key": "threat-group-identifier:apt43" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "TTP", "type": "ttp", "value": "Business email compromise", "key": "ttp:business-email-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "TTP", "type": "ttp", "value": "Obfuscation", "key": "ttp:obfuscation" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2023", "key": "year:2023" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-071", "title": "Threat Predictions for 2024: Chained AI and CaaS Operations Give Attackers More “Easy” Buttons Than Ever | FortiGuard Labs", "description": "Fortinet forecast or strategic assessment covering Reconnaissance and target research, Ransomware deployment, and Generative AI. Indexed with Energy context.", "url": "https://www.fortinet.com/blog/threat-research/2024-threat-predictions-chained-ai-and-caas-operations", "publisher": "Fortinet", "published_at": "2023-11-09", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "24 hours · medium confidence", "key": "metric:24-hours-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Fortinet", "key": "publisher:fortinet" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "fortinet.com", "key": "publisher-domain:fortinet.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat assessment, forecast, or red-team study", "key": "relevance-basis:threat-assessment-forecast-or-red-team-study" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Energy", "key": "sector:energy" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "forecast or strategic assessment", "key": "source-type:forecast-or-strategic-assessment" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_only", "key": "statistical-use:context-only" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Ransomware deployment", "key": "ttp:ransomware-deployment" }, { "facet": "Year", "type": "year", "value": "2023", "key": "year:2023" } ], "used_in": [] }, { "id": "site-reference:threatconnect.com:f385cf2558110038", "title": "ThreatConnect", "description": "External source cited by 1 maintained 1200km page.", "url": "https://threatconnect.com", "publisher": "Threatconnect", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "threatconnect.com", "key": "publisher-domain:threatconnect.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-110", "title": "ThreatDown State of Malware Report 2025: Autonomous AI and Ransomware", "description": "ThreatDown / Malwarebytes threat-research report covering Malicious advertising, Agentic AI, and Generative AI. Indexed with Healthcare and OpenAI context.", "url": "https://www.threatdown.com/blog/threatdown-state-of-malware-report-2025/", "publisher": "ThreatDown / Malwarebytes", "published_at": "2025-02-04", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Malicious advertisement", "key": "attack-vector:malicious-advertisement" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "1 minute · medium confidence", "key": "metric:1-minute-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "12 minutes · medium confidence", "key": "metric:12-minutes-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "12 months · medium confidence", "key": "metric:12-months-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$75 million · medium confidence", "key": "metric:75-million-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "13% · medium confidence", "key": "metric:13-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "70% · medium confidence", "key": "metric:70-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "LLM model", "type": "llm_model", "value": "Grok", "key": "llm-model:grok" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "xAI", "key": "llm-provider:xai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "AMOS", "key": "malware-or-tool:amos" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "ThreatDown / Malwarebytes", "key": "publisher:threatdown-/-malwarebytes" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "threatdown.com", "key": "publisher-domain:threatdown.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Healthcare", "key": "sector:healthcare" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Malicious advertising", "key": "ttp:malicious-advertising" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "ai-attack-reference:pub-116", "title": "ThreatLabz 2025 AI Security Report", "description": "Zscaler ThreatLabz threat-research report covering Autonomous or agentic intrusion, Deepfake video or image, and Deepfake voice. Indexed with Artificial Intelligence and Anthropic context.", "url": "https://www.zscaler.com/blogs/security-research/threatlabz-ai-security-report-key-findings", "publisher": "Zscaler ThreatLabz", "published_at": "2025-03-20", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI technology", "type": "ai_technology", "value": "Speech or voice synthesis", "key": "ai-technology:speech-or-voice-synthesis" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Autonomous or agentic intrusion", "key": "ai-use-case:autonomous-or-agentic-intrusion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake voice", "key": "ai-use-case:deepfake-voice" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "Africa", "key": "country-or-region:africa" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "European Union", "key": "country-or-region:european-union" }, { "facet": "Country or region", "type": "country_or_region", "value": "France", "key": "country-or-region:france" }, { "facet": "Country or region", "type": "country_or_region", "value": "Germany", "key": "country-or-region:germany" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "United Kingdom", "key": "country-or-region:united-kingdom" }, { "facet": "Country or region", "type": "country_or_region", "value": "United States", "key": "country-or-region:united-states" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Personally identifiable information", "key": "data-type:personally-identifiable-information" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "317,583,902 User · medium confidence", "key": "metric:317-583-902-user-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "5 countries · medium confidence", "key": "metric:5-countries-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$0.55 · medium confidence", "key": "metric:0.55-medium-confidence" }, { "facet": "Extracted metric · Financial Value", "type": "metric", "value": "$1 billion · medium confidence", "key": "metric:1-billion-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "0.3% · medium confidence", "key": "metric:0.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.1% · medium confidence", "key": "metric:1.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.2% · medium confidence", "key": "metric:1.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.3% · medium confidence", "key": "metric:1.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.4% · medium confidence", "key": "metric:1.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.6% · medium confidence", "key": "metric:1.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.7% · medium confidence", "key": "metric:1.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1.8% · medium confidence", "key": "metric:1.8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "1% · medium confidence", "key": "metric:1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10.1% · medium confidence", "key": "metric:10.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "10.8% · medium confidence", "key": "metric:10.8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11.3% · medium confidence", "key": "metric:11.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11.4% · medium confidence", "key": "metric:11.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11.5% · medium confidence", "key": "metric:11.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12.2% · medium confidence", "key": "metric:12.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12.4% · medium confidence", "key": "metric:12.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12.5% · medium confidence", "key": "metric:12.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "12.7 % · medium confidence", "key": "metric:12.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "13.6 % · medium confidence", "key": "metric:13.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "15.0% · medium confidence", "key": "metric:15.0-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "15.2% · medium confidence", "key": "metric:15.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "15% · medium confidence", "key": "metric:15-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "17.23% · medium confidence", "key": "metric:17.23-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "18.4% · medium confidence", "key": "metric:18.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "18.5% · medium confidence", "key": "metric:18.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "19.2% · medium confidence", "key": "metric:19.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.0% · medium confidence", "key": "metric:2.0-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.2% · medium confidence", "key": "metric:2.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.3% · medium confidence", "key": "metric:2.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.4% · medium confidence", "key": "metric:2.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.5% · medium confidence", "key": "metric:2.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.6% · medium confidence", "key": "metric:2.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "2.9% · medium confidence", "key": "metric:2.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "21.0% · medium confidence", "key": "metric:21.0-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "21.6% · medium confidence", "key": "metric:21.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "22.3% · medium confidence", "key": "metric:22.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "24.8% · medium confidence", "key": "metric:24.8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "27.1% · medium confidence", "key": "metric:27.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "28.3% · medium confidence", "key": "metric:28.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "28.4% · medium confidence", "key": "metric:28.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "29.1% · medium confidence", "key": "metric:29.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.0% · medium confidence", "key": "metric:3.0-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.1% · medium confidence", "key": "metric:3.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.2% · medium confidence", "key": "metric:3.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.3% · medium confidence", "key": "metric:3.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.4% · medium confidence", "key": "metric:3.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.6% · medium confidence", "key": "metric:3.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3.9% · medium confidence", "key": "metric:3.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "36.4% · medium confidence", "key": "metric:36.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "36% · medium confidence", "key": "metric:36-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "39.5% · medium confidence", "key": "metric:39.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4.1% · medium confidence", "key": "metric:4.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4.2% · medium confidence", "key": "metric:4.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4.4% · medium confidence", "key": "metric:4.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4.5% · medium confidence", "key": "metric:4.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "4.6% · medium confidence", "key": "metric:4.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "40.9% · medium confidence", "key": "metric:40.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "41.5% · medium confidence", "key": "metric:41.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "45.2% · medium confidence", "key": "metric:45.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "46.2% · medium confidence", "key": "metric:46.2-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "46.9% · medium confidence", "key": "metric:46.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "464.6% · medium confidence", "key": "metric:464.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5.1% · medium confidence", "key": "metric:5.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5.6% · medium confidence", "key": "metric:5.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5.7% · medium confidence", "key": "metric:5.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5.74% · medium confidence", "key": "metric:5.74-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5.8% · medium confidence", "key": "metric:5.8-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "53.1% · medium confidence", "key": "metric:53.1-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "54% · medium confidence", "key": "metric:54-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "59.9% · medium confidence", "key": "metric:59.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.0% · medium confidence", "key": "metric:6.0-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.4% · medium confidence", "key": "metric:6.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.5% · medium confidence", "key": "metric:6.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.9% · medium confidence", "key": "metric:6.9-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "60.4% · medium confidence", "key": "metric:60.4-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "68% · medium confidence", "key": "metric:68-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8.7 % · medium confidence", "key": "metric:8.7-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "9.6% · medium confidence", "key": "metric:9.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "90% · medium confidence", "key": "metric:90-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "ChatGPT", "key": "llm-model:chatgpt" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "DeepSeek", "key": "llm-model:deepseek" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM model", "type": "llm_model", "value": "GPT-4", "key": "llm-model:gpt-4" }, { "facet": "LLM model", "type": "llm_model", "value": "Grok", "key": "llm-model:grok" }, { "facet": "LLM model", "type": "llm_model", "value": "Microsoft Copilot", "key": "llm-model:microsoft-copilot" }, { "facet": "LLM model", "type": "llm_model", "value": "Mistral / Mixtral", "key": "llm-model:mistral-/-mixtral" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "DeepSeek", "key": "llm-provider:deepseek" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Microsoft", "key": "llm-provider:microsoft" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Mistral AI", "key": "llm-provider:mistral-ai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "OpenAI", "key": "llm-provider:openai" }, { "facet": "LLM provider", "type": "llm_provider", "value": "xAI", "key": "llm-provider:xai" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "Rhadamanthys", "key": "malware-or-tool:rhadamanthys" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Zscaler ThreatLabz", "key": "publisher:zscaler-threatlabz" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "zscaler.com", "key": "publisher-domain:zscaler.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Artificial Intelligence", "key": "sector:artificial-intelligence" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Healthcare", "key": "sector:healthcare" }, { "facet": "Sector", "type": "sector", "value": "Transportation and Logistics", "key": "sector:transportation-and-logistics" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "Phishing link or attachment", "key": "ttp:phishing-link-or-attachment" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Prompt injection", "key": "ttp:prompt-injection" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:tiktok.com:c1669bcd07800133", "title": "TikTok", "description": "External source cited by 1 maintained 1200km page.", "url": "https://tiktok.com/@messyfounder", "publisher": "Tiktok", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "tiktok.com", "key": "publisher-domain:tiktok.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:huggingface.co:a813c0407304610e", "title": "Tokenizer summary", "description": "External source cited by 1 maintained 1200km page.", "url": "https://huggingface.co/docs/transformers/v5.15.1/tokenizer_summary", "publisher": "Huggingface", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "huggingface.co", "key": "publisher-domain:huggingface.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:github.com:578e1dcca9ed5eed", "title": "tools/opencti_import.py", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/operation-desert-hydra/blob/main/tools/opencti_import.py", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:aquasecurity.github.io:6fb541f52fe4bde5", "title": "Tracee Documentation | Aqua Security", "description": "External source cited by 1 maintained 1200km page.", "url": "https://aquasecurity.github.io/tracee/latest", "publisher": "Aquasecurity Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "aquasecurity.github.io", "key": "publisher-domain:aquasecurity.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:first.org:11376ef112724bd1", "title": "Traffic Light Protocol (TLP)", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.first.org/tlp", "publisher": "First", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "first.org", "key": "publisher-domain:first.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "type": "article", "domain": "detection-engineering" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:blog.trailofbits.com:3feede2bd17085ac", "title": "Trail of Bits LeftoverLocals / CVE-2023–4969", "description": "External source cited by 1 maintained 1200km page.", "url": "https://blog.trailofbits.com/2024/01/16/leftoverlocals-listening-to-llm-responses-through-leaked-gpu-local-memory", "publisher": "BLOG Trailofbits", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.trailofbits.com", "key": "publisher-domain:blog.trailofbits.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:markdown2medium.vercel.app:2735840f3f0af2e3", "title": "training-cluster log-listener", "description": "External source cited by 1 maintained 1200km page.", "url": "https://markdown2medium.vercel.app/training-cluster/README.md", "publisher": "Markdown2medium Vercel", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "markdown2medium.vercel.app", "key": "publisher-domain:markdown2medium.vercel.app" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:training.linuxfoundation.org:67821a086bfc59a3", "title": "training.linuxfoundation.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist", "publisher": "Training Linuxfoundation", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "training.linuxfoundation.org", "key": "publisher-domain:training.linuxfoundation.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:training.linuxfoundation.org:a3d2e71cd41ca238", "title": "training.linuxfoundation.org", "description": "External source cited by 1 maintained 1200km page.", "url": "https://training.linuxfoundation.org/training/kubernetes-security-fundamentals-lfs460", "publisher": "Training Linuxfoundation", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "training.linuxfoundation.org", "key": "publisher-domain:training.linuxfoundation.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:training.trainsec.net:52767a2786000299", "title": "TrainSec — Malware Analyst Professional, Level 1", "description": "External source cited by 7 maintained 1200km pages.", "url": "https://training.trainsec.net/malware-analyst-professional-level-1/v6dfz", "publisher": "Training Trainsec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "training.trainsec.net", "key": "publisher-domain:training.trainsec.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "case-study", "key": "used-by-type:case-study" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "type": "article", "domain": "malware-analysis" }, { "title": "Course Review — TrainSec Malware Analyst Professional — Level 1", "url": "https://1200km.com/articles/read/2026/2026-08-19-course-review-trainsec-malware-analyst-professional-level-1-203ca89b76a2/", "type": "article", "domain": "malware-analysis" }, { "title": "How to Build a Safe Malware Analysis Lab with FLARE-VM, REMnux, and INetSim", "url": "https://1200km.com/articles/read/2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602/", "type": "article", "domain": "malware-analysis" }, { "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "type": "article", "domain": "malware-analysis" }, { "title": "Strings Analysis for Malware Analysis: Turning Binary Text into Defensible Hypotheses", "url": "https://1200km.com/articles/read/2026/2026-08-12-strings-analysis-for-malware-analysis-turning-391815ee35e2/", "type": "article", "domain": "malware-analysis" }, { "title": "TrainSec Malware Analyst Professional Level 1", "url": "https://1200km.com/courses/trainsec-malware-analyst-professional-level-1/", "type": "case-study", "domain": "malware-analysis" }, { "title": "What Is Malware?", "url": "https://1200km.com/articles/read/2026/2026-08-06-what-is-malware-93746950ce9a/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:arxiv.org:1d643d3ccb11233d", "title": "Tramèr et al. — Stealing Machine Learning Models via Prediction APIs", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://arxiv.org/abs/1609.02943", "publisher": "Arxiv", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "arxiv.org", "key": "publisher-domain:arxiv.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "type": "article", "domain": "ai-security" } ] }, { "id": "site-reference:mirror.gpmidi.net:598ebfa71ac88079", "title": "Trellix — The Iranian Cyber Capability PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://mirror.gpmidi.net/vx-underground/Malware%20Analysis/2024/2024-09-19%20-%20The%20Iranian%20Cyber%20Capability/Paper/2024-09-19%20-%20The%20Iranian%20Cyber%20Capability.pdf", "publisher": "Mirror Gpmidi", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "mirror.gpmidi.net", "key": "publisher-domain:mirror.gpmidi.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:documents.trendmicro.com:ec3e2acc460f7ba8", "title": "Trend Micro — Annual APT Report 2025 PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://documents.trendmicro.com/assets/pdf/Annual_APT_Report_2025.pdf", "publisher": "Documents Trendmicro", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "documents.trendmicro.com", "key": "publisher-domain:documents.trendmicro.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:trendmicro.com:50ea1f9ffe0aff5f", "title": "Trend Micro Cyclops Blink / ASUS", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html", "publisher": "Trendmicro", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "trendmicro.com", "key": "publisher-domain:trendmicro.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:trendmicro.com:ea0b1637b97e4e09", "title": "Trend Micro, Hype vs. Reality: AI in the Cybercriminal Underground", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.trendmicro.com/vinfo/gb/security/news/cybercrime-and-digital-threats/hype-vs-reality-ai-in-the-cybercriminal-underground", "publisher": "Trendmicro", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "trendmicro.com", "key": "publisher-domain:trendmicro.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:trendmicro.com:1e149fc70e26a64a", "title": "trendmicro.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.trendmicro.com/vinfo/us/security/news/security-technology/a-deep-dive-into-kubernetes-threat-modeling", "publisher": "Trendmicro", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "trendmicro.com", "key": "publisher-domain:trendmicro.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-048", "title": "TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development", "description": "Palo Alto Networks Unit 42 operational CTI publication covering CAPTCHA bypass, Malware development, and Command and control. Indexed with Cryptocurrency and Anthropic context.", "url": "https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/", "publisher": "Palo Alto Networks Unit 42", "published_at": "2026-07-15", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Large language model", "key": "ai-technology:large-language-model" }, { "facet": "AI use case", "type": "ai_use_case", "value": "CAPTCHA bypass", "key": "ai-use-case:captcha-bypass" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Malware development", "key": "ai-use-case:malware-development" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Country or region", "type": "country_or_region", "value": "India", "key": "country-or-region:india" }, { "facet": "Country or region", "type": "country_or_region", "value": "Iran", "key": "country-or-region:iran" }, { "facet": "Country or region", "type": "country_or_region", "value": "Japan", "key": "country-or-region:japan" }, { "facet": "Country or region", "type": "country_or_region", "value": "South Korea", "key": "country-or-region:south-korea" }, { "facet": "CVE", "type": "cve", "value": "CVE-2007-3010", "key": "cve:cve-2007-3010" }, { "facet": "CVE", "type": "cve", "value": "CVE-2007-5693", "key": "cve:cve-2007-5693" }, { "facet": "CVE", "type": "cve", "value": "CVE-2013-7471", "key": "cve:cve-2013-7471" }, { "facet": "CVE", "type": "cve", "value": "CVE-2014-2321", "key": "cve:cve-2014-2321" }, { "facet": "CVE", "type": "cve", "value": "CVE-2014-8361", "key": "cve:cve-2014-8361" }, { "facet": "CVE", "type": "cve", "value": "CVE-2016-11021", "key": "cve:cve-2016-11021" }, { "facet": "CVE", "type": "cve", "value": "CVE-2017-17215", "key": "cve:cve-2017-17215" }, { "facet": "CVE", "type": "cve", "value": "CVE-2017-18377", "key": "cve:cve-2017-18377" }, { "facet": "CVE", "type": "cve", "value": "CVE-2018-10561", "key": "cve:cve-2018-10561" }, { "facet": "CVE", "type": "cve", "value": "CVE-2018-10562", "key": "cve:cve-2018-10562" }, { "facet": "CVE", "type": "cve", "value": "CVE-2018-20062", "key": "cve:cve-2018-20062" }, { "facet": "CVE", "type": "cve", "value": "CVE-2020-17456", "key": "cve:cve-2020-17456" }, { "facet": "CVE", "type": "cve", "value": "CVE-2020-8515", "key": "cve:cve-2020-8515" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-25646", "key": "cve:cve-2021-25646" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-4045", "key": "cve:cve-2021-4045" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-1388", "key": "cve:cve-2022-1388" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-22947", "key": "cve:cve-2022-22947" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-22965", "key": "cve:cve-2022-22965" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-30525", "key": "cve:cve-2022-30525" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-44877", "key": "cve:cve-2022-44877" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-1389", "key": "cve:cve-2023-1389" }, { "facet": "CVE", "type": "cve", "value": "CVE-2023-39780", "key": "cve:cve-2023-39780" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-34037", "key": "cve:cve-2025-34037" }, { "facet": "CVE", "type": "cve", "value": "CVE-2025-34117", "key": "cve:cve-2025-34117" }, { "facet": "CVE", "type": "cve", "value": "CVE-2026-5815", "key": "cve:cve-2026-5815" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "17 target · medium confidence", "key": "metric:17-target-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "17 targets · medium confidence", "key": "metric:17-targets-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "20 domains · medium confidence", "key": "metric:20-domains-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "20 system · medium confidence", "key": "metric:20-system-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "82 samples · medium confidence", "key": "metric:82-samples-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "9 samples · medium confidence", "key": "metric:9-samples-medium-confidence" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "approximately 92 individual · medium confidence", "key": "metric:approximately-92-individual-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "10 seconds · medium confidence", "key": "metric:10-seconds-medium-confidence" }, { "facet": "Extracted metric · Duration Or Dwell", "type": "metric", "value": "5 seconds · medium confidence", "key": "metric:5-seconds-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "5% · medium confidence", "key": "metric:5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "70% · medium confidence", "key": "metric:70-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Impact", "type": "impact", "value": "Service disruption", "key": "impact:service-disruption" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Mobile", "key": "infrastructure:mobile" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "digikalas[.]online", "key": "ioc:digikalas-.-online" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "jetross[.]com", "key": "ioc:jetross-.-com" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "2774a5f5991657eb9b0062cd3da0391c9bad2643", "key": "ioc:2774a5f5991657eb9b0062cd3da0391c9bad2643" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "304e14a138b92135aad27bb37f4e9db440401ec2", "key": "ioc:304e14a138b92135aad27bb37f4e9db440401ec2" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "4cba585d9f208bd712b28f867f908e503ccc9cfe", "key": "ioc:4cba585d9f208bd712b28f867f908e503ccc9cfe" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "4e1483737f769e1cee80fa4d7a056a5d8e3b537e", "key": "ioc:4e1483737f769e1cee80fa4d7a056a5d8e3b537e" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "64af594c7f91793813e3d769e63816b143102396", "key": "ioc:64af594c7f91793813e3d769e63816b143102396" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "69dc276dde8efcb409411508da55d4cbe28d5600", "key": "ioc:69dc276dde8efcb409411508da55d4cbe28d5600" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "74fba0bad93bbb0e1eedb196b6efe6af1c0bf23d", "key": "ioc:74fba0bad93bbb0e1eedb196b6efe6af1c0bf23d" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "7ad840b1945cc346012987727ebcc062431965a4", "key": "ioc:7ad840b1945cc346012987727ebcc062431965a4" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "81670f250f4b3492fd3e00920f9fe7395ecbf85c", "key": "ioc:81670f250f4b3492fd3e00920f9fe7395ecbf85c" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "877b804892ab218a53420b6dfbd0a2837368d0b5", "key": "ioc:877b804892ab218a53420b6dfbd0a2837368d0b5" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "a70cea846442c18ad265f311b5ced29a4071771d", "key": "ioc:a70cea846442c18ad265f311b5ced29a4071771d" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "a8fd13f6b1bdfa87c0f466df69b7e81325b5dd15", "key": "ioc:a8fd13f6b1bdfa87c0f466df69b7e81325b5dd15" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "adf267caab78a74c4b4dfabe7b578b0a4d639782", "key": "ioc:adf267caab78a74c4b4dfabe7b578b0a4d639782" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "b1cc41e2b9ddb11d0c9d03d319531fea9459cdae", "key": "ioc:b1cc41e2b9ddb11d0c9d03d319531fea9459cdae" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "b21cdc5e1b96c640a1d553ed518c49729e367823", "key": "ioc:b21cdc5e1b96c640a1d553ed518c49729e367823" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "befb0e4d1cd7d2b4139b55f811993af2c8839e75", "key": "ioc:befb0e4d1cd7d2b4139b55f811993af2c8839e75" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "cd540bb31909440fd2bf773e6f1480f5b6f12400", "key": "ioc:cd540bb31909440fd2bf773e6f1480f5b6f12400" }, { "facet": "IOC · Sha1", "type": "ioc", "value": "e0f8dd23e4fb0086feb42ea0a5dcef70d7b4d17c", "key": "ioc:e0f8dd23e4fb0086feb42ea0a5dcef70d7b4d17c" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "0f8bcca3ed65e980da2a1f90a767b7d543be32eeea3e9338d09d4d635a497988", "key": "ioc:0f8bcca3ed65e980da2a1f90a767b7d543be32eeea3e9338d09d4d635a497988" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "146f6010f6ee082aab13e0148d39baefa77eaba4ff65817b511b08c2092bdfd2", "key": "ioc:146f6010f6ee082aab13e0148d39baefa77eaba4ff65817b511b08c2092bdfd2" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "15c17dce89deccd5172285b2650de957918aa1157cde8e4633ae15dfe31f2711", "key": "ioc:15c17dce89deccd5172285b2650de957918aa1157cde8e4633ae15dfe31f2711" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "246c97957651de568e61eba1abe572f0b0f960456209995d43d53a0d7cc494a1", "key": "ioc:246c97957651de568e61eba1abe572f0b0f960456209995d43d53a0d7cc494a1" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "2f2c3551762c03da126e45dca6fc2f997c63f0f1bfc21fd0ceed680ac6f083ce", "key": "ioc:2f2c3551762c03da126e45dca6fc2f997c63f0f1bfc21fd0ceed680ac6f083ce" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "3ec016d637e4c9cd331edd2580a229621ad638e924a4aa29ac0342e9144ace19", "key": "ioc:3ec016d637e4c9cd331edd2580a229621ad638e924a4aa29ac0342e9144ace19" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "511d3ffb4091cbcc94571d9fb3102e8cb424c6e187d01d53ff12078d54929bda", "key": "ioc:511d3ffb4091cbcc94571d9fb3102e8cb424c6e187d01d53ff12078d54929bda" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "6aa4034dc7a2858094ff4dc59af07d6fe31119591e41599bcc0f3d0b516ee734", "key": "ioc:6aa4034dc7a2858094ff4dc59af07d6fe31119591e41599bcc0f3d0b516ee734" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "6b7a8e0c96c2318e747f074f9a99d26738700769ac01bba692d19fc884847737", "key": "ioc:6b7a8e0c96c2318e747f074f9a99d26738700769ac01bba692d19fc884847737" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d", "key": "ioc:71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "96b1f96efca3b9df2dea85678d60da27e3265b4a00e39e20e64b27bb985e1561", "key": "ioc:96b1f96efca3b9df2dea85678d60da27e3265b4a00e39e20e64b27bb985e1561" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "9cd5e7e3c8bad321ef6c3d47fe25b3b56e9487f703a7eeee52db4067e6bafe61", "key": "ioc:9cd5e7e3c8bad321ef6c3d47fe25b3b56e9487f703a7eeee52db4067e6bafe61" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "a03b0d41f5ef03328150331ffa0ed970998883f7e0343d79b2d3b95330d8e7c1", "key": "ioc:a03b0d41f5ef03328150331ffa0ed970998883f7e0343d79b2d3b95330d8e7c1" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "a8d70d16509e227d8306be361bc37a3dc9fe34bf476f51e361e55e6d293c2b3f", "key": "ioc:a8d70d16509e227d8306be361bc37a3dc9fe34bf476f51e361e55e6d293c2b3f" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "bd6431fb06e4689142ef597cf00382e38ae20a5393a4d9277e45a3f5b3cbcff9", "key": "ioc:bd6431fb06e4689142ef597cf00382e38ae20a5393a4d9277e45a3f5b3cbcff9" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c7a36d6b8128c41f93a32413675401a10a2b5769b221bbaa8c5c309585b73ceb", "key": "ioc:c7a36d6b8128c41f93a32413675401a10a2b5769b221bbaa8c5c309585b73ceb" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "e3a5296e762e9ee16010399666441d663beeea956382e97cca032a6a5ad06811", "key": "ioc:e3a5296e762e9ee16010399666441d663beeea956382e97cca032a6a5ad06811" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "eb2fa179fde2f097c18d5d700ad87d660fc238ee14cbe5477032e60856859621", "key": "ioc:eb2fa179fde2f097c18d5d700ad87d660fc238ee14cbe5477032e60856859621" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "f1efb78887bb8783d7781c07cd13b53c9c79ebe5baa81f335838d0a6e73dec7e", "key": "ioc:f1efb78887bb8783d7781c07cd13b53c9c79ebe5baa81f335838d0a6e73dec7e" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "f324a45fcd2a9db4e542c09486c21b08bc42d6bf76fbd5f17871090361b10815", "key": "ioc:f324a45fcd2a9db4e542c09486c21b08bc42d6bf76fbd5f17871090361b10815" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "IoT botnet", "key": "malware-or-tool:iot-botnet" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "TuxBot", "key": "malware-or-tool:tuxbot" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Resource Development", "key": "mitre-tactic:resource-development" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Palo Alto Networks Unit 42", "key": "publisher:palo-alto-networks-unit-42" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "CAPTCHA bypass", "key": "ttp:captcha-bypass" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Malware generation", "key": "ttp:malware-generation" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:media.defense.gov:82c65bbe3be3ffaf", "title": "U.S. Cyber Command / Defense media — AA22–055A PDF mirror", "description": "External source cited by 1 maintained 1200km page.", "url": "https://media.defense.gov/2022/Feb/24/2002944274/-1/-1/0/CSA_AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations.PDF", "publisher": "Media Defense", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "media.defense.gov", "key": "publisher-domain:media.defense.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:iranwatch.org:1ad0aba4ecd5d87b", "title": "U.S. Cyber Command / Iran Watch mirror — Iranian intel cyber suite of malware PDF", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.iranwatch.org/sites/default/files/cybercom_muddywater_press_release.pdf", "publisher": "Iranwatch", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "iranwatch.org", "key": "publisher-domain:iranwatch.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:ofac.treasury.gov:e00cbcf60754a978", "title": "U.S. Treasury / OFAC, Guidance on the Democratic People’s Republic of Korea Information Technology Workers", "description": "External source cited by 1 maintained 1200km page.", "url": "https://ofac.treasury.gov/system/files/126/20220516_dprk_it_worker_advisory.pdf", "publisher": "OFAC Treasury", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "ofac.treasury.gov", "key": "publisher-domain:ofac.treasury.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "ai-attack-reference:pub-007", "title": "UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations", "description": "Cisco Talos operational CTI publication covering Code debugging and scripting, Identity fraud and impersonation, and Obfuscation and evasion. Indexed with UAT-10147, Education, and Anthropic context.", "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "publisher": "Cisco Talos", "published_at": "2026-08-20", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Code debugging and scripting", "key": "ai-use-case:code-debugging-and-scripting" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Identity fraud and impersonation", "key": "ai-use-case:identity-fraud-and-impersonation" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Obfuscation and evasion", "key": "ai-use-case:obfuscation-and-evasion" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Vulnerability research", "key": "ai-use-case:vulnerability-research" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Credential theft", "key": "attack-vector:credential-theft" }, { "facet": "Country or region", "type": "country_or_region", "value": "Brazil", "key": "country-or-region:brazil" }, { "facet": "Country or region", "type": "country_or_region", "value": "Canada", "key": "country-or-region:canada" }, { "facet": "Country or region", "type": "country_or_region", "value": "China", "key": "country-or-region:china" }, { "facet": "Country or region", "type": "country_or_region", "value": "Vietnam", "key": "country-or-region:vietnam" }, { "facet": "CVE", "type": "cve", "value": "CVE-2010-3904", "key": "cve:cve-2010-3904" }, { "facet": "CVE", "type": "cve", "value": "CVE-2015-3246", "key": "cve:cve-2015-3246" }, { "facet": "CVE", "type": "cve", "value": "CVE-2015-5287", "key": "cve:cve-2015-5287" }, { "facet": "CVE", "type": "cve", "value": "CVE-2019-18935", "key": "cve:cve-2019-18935" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-23758", "key": "cve:cve-2021-23758" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-29441", "key": "cve:cve-2021-29441" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-29442", "key": "cve:cve-2021-29442" }, { "facet": "CVE", "type": "cve", "value": "CVE-2021-3156", "key": "cve:cve-2021-3156" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-0847", "key": "cve:cve-2022-0847" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-0995", "key": "cve:cve-2022-0995" }, { "facet": "CVE", "type": "cve", "value": "CVE-2022-27925", "key": "cve:cve-2022-27925" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Proof of concept", "key": "evidence-landscape:proof-of-concept" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "0995 targets · medium confidence", "key": "metric:0995-targets-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Email", "key": "infrastructure:email" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "SaaS", "key": "infrastructure:saas" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Weaponization", "key": "kill-chain-phase:weaponization" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "BadIIS malware", "key": "malware-or-tool:badiis-malware" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "QuasarRAT", "key": "malware-or-tool:quasarrat" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Credential Access", "key": "mitre-tactic:credential-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Defense Evasion", "key": "mitre-tactic:defense-evasion" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Cisco Talos", "key": "publisher:cisco-talos" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "blog.talosintelligence.com", "key": "publisher-domain:blog.talosintelligence.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Education", "key": "sector:education" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Security researchers", "key": "target:security-researchers" }, { "facet": "Threat group", "type": "threat_group", "value": "UAT-10147", "key": "threat-group:uat-10147" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UAT-10147", "key": "threat-group-identifier:uat-10147" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Defense evasion", "key": "ttp:defense-evasion" }, { "facet": "TTP", "type": "ttp", "value": "PowerShell execution", "key": "ttp:powershell-execution" }, { "facet": "TTP", "type": "ttp", "value": "Vulnerability scanning", "key": "ttp:vulnerability-scanning" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:cloud.google.com:397438c2c1430df1", "title": "UDM Field List | Google Security Operations | Google Cloud", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/chronicle/docs/reference/udm-field-list", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:gov.uk:15d3ab3b08b08958", "title": "UK Government, Foreign Office Minister condemns Russia for NotPetya", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.gov.uk/government/news/foreign-office-minister-condemns-russia-for-notpetya-attacks", "publisher": "GOV", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "gov.uk", "key": "publisher-domain:gov.uk" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" }, { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "ai-attack-reference:pub-021", "title": "UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering", "description": "Google Threat Intelligence Group / Mandiant operational CTI publication covering Deepfake video or image, Reconnaissance and target research, and Translation and localization. Indexed with BlueNoroff, Cryptocurrency, and Google context.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering", "publisher": "Google Threat Intelligence Group / Mandiant", "published_at": "2026-02-10", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Financial", "key": "actor-motivation:financial" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Deepfake / synthetic media", "key": "ai-technology:deepfake-/-synthetic-media" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Deepfake video or image", "key": "ai-use-case:deepfake-video-or-image" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Reconnaissance and target research", "key": "ai-use-case:reconnaissance-and-target-research" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Translation and localization", "key": "ai-use-case:translation-and-localization" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Spearphishing", "key": "attack-vector:spearphishing" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Supply chain", "key": "attack-vector:supply-chain" }, { "facet": "Attack vector", "type": "attack_vector", "value": "Vishing", "key": "attack-vector:vishing" }, { "facet": "Country or region", "type": "country_or_region", "value": "North Korea", "key": "country-or-region:north-korea" }, { "facet": "Country or region", "type": "country_or_region", "value": "Russia", "key": "country-or-region:russia" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Data type", "type": "data_type", "value": "Session cookies or tokens", "key": "data-type:session-cookies-or-tokens" }, { "facet": "Data type", "type": "data_type", "value": "Source code", "key": "data-type:source-code" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted IOCs", "key": "evidence-inventory:contains-extracted-iocs" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "In-the-wild observed", "key": "evidence-landscape:in-the-wild-observed" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Endpoint", "key": "infrastructure:endpoint" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Messaging platform", "key": "infrastructure:messaging-platform" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Social media", "key": "infrastructure:social-media" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "breakdream[.]com", "key": "ioc:breakdream-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "dreamdie[.]com", "key": "ioc:dreamdie-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "mylingocoin[.]com", "key": "ioc:mylingocoin-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "supportzm[.]com", "key": "ioc:supportzm-.-com" }, { "facet": "IOC · Defanged Domain", "type": "ioc", "value": "zmsupport[.]com", "key": "ioc:zmsupport-.-com" }, { "facet": "IOC · Md5", "type": "ioc", "value": "3712793d3847dd0962361aa528fa124c", "key": "ioc:3712793d3847dd0962361aa528fa124c" }, { "facet": "IOC · Md5", "type": "ioc", "value": "4e4f2dfe143ba261fd8a18d1c4b58f2e", "key": "ioc:4e4f2dfe143ba261fd8a18d1c4b58f2e" }, { "facet": "IOC · Md5", "type": "ioc", "value": "c91725905b273e81e9cc6983a11c8d60", "key": "ioc:c91725905b273e81e9cc6983a11c8d60" }, { "facet": "IOC · Md5", "type": "ioc", "value": "eb7635f4836c9e0aa4c315b18b051cb5", "key": "ioc:eb7635f4836c9e0aa4c315b18b051cb5" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "03f00a143b8929585c122d490b6a3895d639c17d92c2223917e3a9ca1b8d30f9", "key": "ioc:03f00a143b8929585c122d490b6a3895d639c17d92c2223917e3a9ca1b8d30f9" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "1a30d6cdb0b98feed62563be8050db55ae0156ed437701d36a7b46aabf086ede", "key": "ioc:1a30d6cdb0b98feed62563be8050db55ae0156ed437701d36a7b46aabf086ede" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "603848f37ab932dccef98ee27e3c5af9221d3b6ccfe457ccf93cb572495ac325", "key": "ioc:603848f37ab932dccef98ee27e3c5af9221d3b6ccfe457ccf93cb572495ac325" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b452c2da7c012eda25a1403b3313444b5eb7c2c3e25eee489f1bd256f8434735", "key": "ioc:b452c2da7c012eda25a1403b3313444b5eb7c2c3e25eee489f1bd256f8434735" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "b525837273dde06b86b5f93f9aec2c29665324105b0b66f6df81884754f8080d", "key": "ioc:b525837273dde06b86b5f93f9aec2c29665324105b0b66f6df81884754f8080d" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c3e5d878a30a6c46e22d1dd2089b32086c91f13f8b9c413aa84e1dbaa03b9375", "key": "ioc:c3e5d878a30a6c46e22d1dd2089b32086c91f13f8b9c413aa84e1dbaa03b9375" }, { "facet": "IOC · Sha256", "type": "ioc", "value": "c8f7608d4e19f6cb03680941bbd09fe969668bcb09c7ca985048a22e014dffcd", "key": "ioc:c8f7608d4e19f6cb03680941bbd09fe969668bcb09c7ca985048a22e014dffcd" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Command and Control", "key": "kill-chain-phase:command-and-control" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Installation", "key": "kill-chain-phase:installation" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Reconnaissance", "key": "kill-chain-phase:reconnaissance" }, { "facet": "LLM model", "type": "llm_model", "value": "Gemini", "key": "llm-model:gemini" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Google", "key": "llm-provider:google" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "HIDDENCALL backdoor", "key": "malware-or-tool:hiddencall-backdoor" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "UNC1069 malware", "key": "malware-or-tool:unc1069-malware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Collection", "key": "mitre-tactic:collection" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Command and Control", "key": "mitre-tactic:command-and-control" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Execution", "key": "mitre-tactic:execution" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Persistence", "key": "mitre-tactic:persistence" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Reconnaissance", "key": "mitre-tactic:reconnaissance" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Text", "key": "publication-date-method:text" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Google Threat Intelligence Group / Mandiant", "key": "publisher:google-threat-intelligence-group-/-mandiant" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "campaign, actor, malware, or abuse investigation", "key": "relevance-basis:campaign-actor-malware-or-abuse-investigation" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Cryptocurrency", "key": "sector:cryptocurrency" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Sector", "type": "sector", "value": "Technology", "key": "sector:technology" }, { "facet": "Sector", "type": "sector", "value": "Telecommunications", "key": "sector:telecommunications" }, { "facet": "Source type", "type": "source_type", "value": "operational CTI publication", "key": "source-type:operational-cti-publication" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "Target", "type": "target", "value": "Employees", "key": "target:employees" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "Threat group", "type": "threat_group", "value": "BlueNoroff", "key": "threat-group:bluenoroff" }, { "facet": "Threat group", "type": "threat_group", "value": "UNC1069", "key": "threat-group:unc1069" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC1069", "key": "threat-group-identifier:unc1069" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC4899", "key": "threat-group-identifier:unc4899" }, { "facet": "Threat-group identifier", "type": "threat_group_identifier", "value": "UNC6671", "key": "threat-group-identifier:unc6671" }, { "facet": "TTP", "type": "ttp", "value": "Command and control", "key": "ttp:command-and-control" }, { "facet": "TTP", "type": "ttp", "value": "Credential harvesting", "key": "ttp:credential-harvesting" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "TTP", "type": "ttp", "value": "Deepfake impersonation", "key": "ttp:deepfake-impersonation" }, { "facet": "TTP", "type": "ttp", "value": "MFA/session-token theft", "key": "ttp:mfa/session-token-theft" }, { "facet": "TTP", "type": "ttp", "value": "Spearphishing", "key": "ttp:spearphishing" }, { "facet": "TTP", "type": "ttp", "value": "Supply-chain compromise", "key": "ttp:supply-chain-compromise" }, { "facet": "TTP", "type": "ttp", "value": "Voice phishing / vishing", "key": "ttp:voice-phishing-/-vishing" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [] }, { "id": "site-reference:cloud.google.com:3c219835133b3189", "title": "UNC3886 Juniper router backdoors ( Ghost in the Router )", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:clang.llvm.org:7e2542a2d9879184", "title": "UndefinedBehaviorSanitizer", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html", "publisher": "Clang LLVM", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "clang.llvm.org", "key": "publisher-domain:clang.llvm.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "vulnerability-research", "key": "used-by-topic:vulnerability-research" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Vulnerability Research & Exploit Development", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "type": "guide", "domain": "vulnerability-research" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:1ac8c06340006572", "title": "Understanding Current Threats to Kubernetes Environments | Palo Alto Unit 42", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/modern-kubernetes-threats", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:microsoft.com:d19b0f8521286519", "title": "Understanding the threat landscape for Kubernetes and containerized assets | Microsoft Security Blog, April 23, 2025", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.microsoft.com/en-us/security/blog/2025/04/23/understanding-the-threat-landscape-for-kubernetes-and-containerized-assets", "publisher": "Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "microsoft.com", "key": "publisher-domain:microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "type": "article", "domain": "detection-engineering" }, { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:unicorn-engine.org:15ce10f631359406", "title": "Unicorn", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.unicorn-engine.org", "publisher": "Unicorn Engine", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unicorn-engine.org", "key": "publisher-domain:unicorn-engine.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Unpacker: A Practical Guide to Modular Malware Packer Detection and Unpacking", "url": "https://1200km.com/articles/read/2026/2026-02-28-unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:40124cb350f6381a", "title": "Unipacker", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/unipacker/unipacker", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Unpacker: A Practical Guide to Modular Malware Packer Detection and Unpacking", "url": "https://1200km.com/articles/read/2026/2026-02-28-unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:f7efa136b855a679", "title": "Unit 42 — Boggy Serpens Threat Assessment", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:paloaltonetworks.com:147f86212c92477f", "title": "Unit 42 Cloud Threat Report 2024", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.paloaltonetworks.com/resources/research/unit42-cloud-threat-report", "publisher": "Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "paloaltonetworks.com", "key": "publisher-domain:paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:d967a37bb8688abc", "title": "Unit 42 Operation MidnightEclipse (CVE-2024–3400)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/cve-2024-3400", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" } ], "used_in": [ { "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:unit42.paloaltonetworks.com:99d2911cb87af42a", "title": "unit42.paloaltonetworks.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline", "publisher": "Unit42 Paloaltonetworks", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "unit42.paloaltonetworks.com", "key": "publisher-domain:unit42.paloaltonetworks.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:trainsec.net:8bea27523129dcf8", "title": "Uriel Kosayev — TrainSec instructor profile", "description": "External source cited by 1 maintained 1200km page.", "url": "https://trainsec.net/uriel-kosayev", "publisher": "Trainsec", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "trainsec.net", "key": "publisher-domain:trainsec.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" } ], "used_in": [ { "title": "Course Review — TrainSec Malware Analyst Professional — Level 1", "url": "https://1200km.com/articles/read/2026/2026-08-19-course-review-trainsec-malware-analyst-professional-level-1-203ca89b76a2/", "type": "article", "domain": "malware-analysis" } ] }, { "id": "site-reference:docs.urlscan.io:c2e58c931f2749e7", "title": "urlscan Documentation Hub", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.urlscan.io", "publisher": "DOCS Urlscan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.urlscan.io", "key": "publisher-domain:docs.urlscan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:docs.urlscan.io:83cb2f2bba5db3ac", "title": "urlscan Search API", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.urlscan.io/apis/urlscan-openapi/search", "publisher": "DOCS Urlscan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.urlscan.io", "key": "publisher-domain:docs.urlscan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:docs.urlscan.io:aba5c06e54d662d3", "title": "urlscan search semantics", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.urlscan.io/pages/search-general", "publisher": "DOCS Urlscan", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.urlscan.io", "key": "publisher-domain:docs.urlscan.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:docs.aws.amazon.com:6b2b86b393b011f4", "title": "Use an IAM role to grant permissions to applications running on Amazon EC2 instances — AWS Identity and Access Management", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Sending EKS Control Plane Logs via AWS Lambda", "url": "https://1200km.com/articles/read/2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:github.com:983d3933768a7cc7", "title": "v7.0.0", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph/blob/2a9a7bedf6115dbcfbf1e90a70e08f50d76e8c73/docs/release-notes/v7.0.0.md", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Historical: AdversaryGraph v4 Capability Map", "url": "https://1200km.com/articles/adversarygraph-v2-self-hosted-ai-cti-platform.html", "type": "mirror", "domain": "threat-intelligence" } ] }, { "id": "site-reference:github.com:52924148fdd0dd5a", "title": "v7.0.0", "description": "External source cited by 1 maintained 1200km page.", "url": "https://github.com/anpa1200/adversarygraph/releases/tag/v7.0.0", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "mirror", "key": "used-by-type:mirror" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Historical: AdversaryGraph v4 Capability Map", "url": "https://1200km.com/articles/adversarygraph-v2-self-hosted-ai-cti-platform.html", "type": "mirror", "domain": "threat-intelligence" } ] }, { "id": "site-reference:docs.velociraptor.app:0d92641ed3c65cc1", "title": "Velociraptor", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.velociraptor.app", "publisher": "DOCS Velociraptor", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.velociraptor.app", "key": "publisher-domain:docs.velociraptor.app" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:sec.gov:73e9bd72c2346e7c", "title": "VEON SEC filing, Kyivstar cyber incident recovery and impact", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sec.gov/Archives/edgar/data/2062440/000206244026000006/R32.htm", "publisher": "SEC", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sec.gov", "key": "publisher-domain:sec.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:sec.gov:177d533d3857a5a0", "title": "VEON SEC filing, Kyivstar network targeted by widespread cyberattack", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.sec.gov/Archives/edgar/data/1468091/000146809123000114/kyivstarnetworktrgted_12.htm", "publisher": "SEC", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "sec.gov", "key": "publisher-domain:sec.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:veon.com:389388766e6f9b97", "title": "VEON, Kyivstar Completes Preliminary Assessment of the Financial Impact of the Cyberattack", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.veon.com/newsroom/press-releases/kyivstar-completes-preliminary-assessment-of-the-financial-impact-of-the-cyberattack", "publisher": "VEON", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "veon.com", "key": "publisher-domain:veon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:veon.com:f0721f0ce639ac9e", "title": "VEON, Kyivstar restores services in all categories, brings 99% of mobile network back on air", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.veon.com/newsroom/press-releases/kyivstar-restores-services-in-all-categories-brings-99-of-mobile-network-back-on-air", "publisher": "VEON", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "veon.com", "key": "publisher-domain:veon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:verisframework.org:c55b4a449b7699aa", "title": "VERIS", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://verisframework.org", "publisher": "Verisframework", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "verisframework.org", "key": "publisher-domain:verisframework.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:verizon.com:e3f2e1f6936f2871", "title": "Verizon Data Breach Investigations Report 2024 (DBIR)", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.verizon.com/business/resources/reports/dbir", "publisher": "Verizon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "verizon.com", "key": "publisher-domain:verizon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "type": "article", "domain": "detection-engineering" }, { "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:verizon.com:f6a32b0786e7e2d2", "title": "verizon.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.verizon.com/business/resources/Ta5a/reports/2023-dbir-public-sector-snapshot.pdf", "publisher": "Verizon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "verizon.com", "key": "publisher-domain:verizon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:docs.metasploit.com:e873a56ae160f587", "title": "View Installation Docs", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.metasploit.com/docs/using-metasploit/getting-started/nightly-installers.html", "publisher": "DOCS Metasploit", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.metasploit.com", "key": "publisher-domain:docs.metasploit.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Ultimate Guide to Metasploit. Part 1.", "url": "https://1200km.com/articles/read/2024/2024-11-17-the-ultimate-guide-to-metasploit-part-1-43c8573487df/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:villainclub.net:a15358da3c477302", "title": "villainclub.net", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.villainclub.net/posts/atomic-vs-composite-detections", "publisher": "Villainclub", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "villainclub.net", "key": "publisher-domain:villainclub.net" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:virustotal.com:106408ce08110a8e", "title": "VirusTotal / Google Threat Intelligence", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://www.virustotal.com", "publisher": "Virustotal", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "virustotal.com", "key": "publisher-domain:virustotal.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" }, { "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:docs.virustotal.com:d99c504e46ef3549", "title": "VirusTotal API v3 concepts and relationships", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.virustotal.com/reference/key-concepts", "publisher": "DOCS Virustotal", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.virustotal.com", "key": "publisher-domain:docs.virustotal.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:docs.virustotal.com:efd7f415dc1d030b", "title": "VirusTotal relationship model", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://docs.virustotal.com/reference/relationships", "publisher": "DOCS Virustotal", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.virustotal.com", "key": "publisher-domain:docs.virustotal.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "open-source-intelligence", "key": "used-by-topic:open-source-intelligence" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "OSINT & Reconnaissance", "url": "https://1200km.com/cyber-knowledge/osint.html", "type": "guide", "domain": "open-source-intelligence" } ] }, { "id": "site-reference:volatility3.readthedocs.io:0970708a2882a76a", "title": "Volatility 3 documentation", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://volatility3.readthedocs.io/en/latest", "publisher": "Volatility3 Readthedocs", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "volatility3.readthedocs.io", "key": "publisher-domain:volatility3.readthedocs.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:github.com:3ee7429e56167792", "title": "Volatility 3 project", "description": "External source cited by 3 maintained 1200km pages.", "url": "https://github.com/volatilityfoundation/volatility3", "publisher": "Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "github.com", "key": "publisher-domain:github.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "incident-response", "key": "used-by-topic:incident-response" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "type": "article", "domain": "threat-intelligence" }, { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Digital Forensics & Incident Response (DFIR)", "url": "https://1200km.com/cyber-knowledge/dfir.html", "type": "guide", "domain": "incident-response" } ] }, { "id": "site-reference:raw.githubusercontent.com:d37c6b2524c2b0d2", "title": "vpn/anyconnect-2024-10-24.log", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/vpn/anyconnect-2024-10-24.log", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:doi.org:03a4f1f2c0635169", "title": "Wang et al. — Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (IEEE S&P 2019)", "description": "External source cited by 1 maintained 1200km page.", "url": "https://doi.org/10.1109/SP.2019.00031", "publisher": "DOI", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "doi.org", "key": "publisher-domain:doi.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:wappalyzer.com:06b27e20f121d87a", "title": "Wappalyzer", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.wappalyzer.com", "publisher": "Wappalyzer", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "wappalyzer.com", "key": "publisher-domain:wappalyzer.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "application-security", "key": "used-by-topic:application-security" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "type": "article", "domain": "offensive-research" }, { "title": "Web Applications Penetretion Testing. Stage 1: Reconnaissance", "url": "https://1200km.com/articles/read/2024/2024-11-10-web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399/", "type": "article", "domain": "application-security" } ] }, { "id": "site-reference:youtube.com:1f40650b3196188d", "title": "Watch on YouTube ↗", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.youtube.com/watch?v=AhCcMOlPxJY", "publisher": "Youtube", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "youtube.com", "key": "publisher-domain:youtube.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:youtube.com:11f69daa792235c6", "title": "Watch on YouTube ↗", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.youtube.com/watch?v=CMdWxIo-Qv8&t=74s", "publisher": "Youtube", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "youtube.com", "key": "publisher-domain:youtube.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:youtube.com:eb5b058dcaeb3fd7", "title": "Watch on YouTube ↗", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.youtube.com/watch?v=OgzkydUdF9I", "publisher": "Youtube", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "youtube.com", "key": "publisher-domain:youtube.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:youtube.com:19951acf6dcbed17", "title": "Watch on YouTube ↗", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.youtube.com/watch?v=Zas3ufXo9wg", "publisher": "Youtube", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "youtube.com", "key": "publisher-domain:youtube.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:youtube.com:7d5d926fe4d6c0e2", "title": "Watch on YouTube ↗", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.youtube.com/watch?v=ZK28lp4qsqI", "publisher": "Youtube", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "youtube.com", "key": "publisher-domain:youtube.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:youtube.com:685b30b78c98567a", "title": "Watch the Chapter 4 lesson on YouTube", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.youtube.com/watch?v=B0lSWuG2UUQ", "publisher": "Youtube", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "youtube.com", "key": "publisher-domain:youtube.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "type": "guide", "domain": "ai-security" } ] }, { "id": "site-reference:weakpass.com:86e208ed43bcbf3d", "title": "Weakpass", "description": "External source cited by 1 maintained 1200km page.", "url": "https://weakpass.com", "publisher": "Weakpass", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "weakpass.com", "key": "publisher-domain:weakpass.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:iana.org:f996182fb89dfb55", "title": "website", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml", "publisher": "IANA", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "iana.org", "key": "publisher-domain:iana.org" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1", "url": "https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/", "type": "article", "domain": "offensive-research" }, { "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 2", "url": "https://1200km.com/articles/read/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:newsletter.plainenglish.io:de150b3c690eed20", "title": "weekly newsletter", "description": "External source cited by 1 maintained 1200km page.", "url": "https://newsletter.plainenglish.io", "publisher": "Newsletter Plainenglish", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "newsletter.plainenglish.io", "key": "publisher-domain:newsletter.plainenglish.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "cloud-security", "key": "used-by-topic:cloud-security" } ], "used_in": [ { "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "type": "article", "domain": "cloud-security" } ] }, { "id": "site-reference:hai.stanford.edu:2f444a826022d920", "title": "What are Foundation Models?", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://hai.stanford.edu/ai-definitions/what-are-foundation-models", "publisher": "HAI Stanford", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "hai.stanford.edu", "key": "publisher-domain:hai.stanford.edu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "type": "article", "domain": "ai-security" }, { "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "type": "research", "domain": "ai-security" } ] }, { "id": "site-reference:medium.com:b7480d0629a15179", "title": "What Do You Want to Read? Your Input Shapes What I Write Next", "description": "External source cited by 1 maintained 1200km page.", "url": "https://medium.com/@1200km/what-do-you-want-to-read-your-input-shapes-what-i-write-next-76fe3355553f", "publisher": "Medium", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "medium.com", "key": "publisher-domain:medium.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "Navigate My Blog: All Articles by Topic", "url": "https://1200km.com/articles/read/2026/2026-03-16-navigate-my-blog-all-articles-by-topic-ffd800ef5480/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:docs.aws.amazon.com:1d5248cfde84c3a6", "title": "What is AWS Lambda? — AWS Lambda", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.aws.amazon.com/lambda/latest/dg/welcome.html", "publisher": "DOCS AWS Amazon", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.aws.amazon.com", "key": "publisher-domain:docs.aws.amazon.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "Sending EKS Control Plane Logs via AWS Lambda", "url": "https://1200km.com/articles/read/2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "ai-attack-reference:pub-050", "title": "What we learned mapping a year’s worth of AI-enabled cyber threats", "description": "Anthropic provider or government report covering Phishing and lure generation, Data exfiltration, and Agentic AI. Indexed with Financial Services and Anthropic context.", "url": "https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack", "publisher": "Anthropic", "published_at": "2026-06-03", "inclusion": "core", "tags": [ { "facet": "Actor motivation", "type": "actor_motivation", "value": "Espionage", "key": "actor-motivation:espionage" }, { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Agentic AI", "key": "ai-technology:agentic-ai" }, { "facet": "AI use case", "type": "ai_use_case", "value": "Phishing and lure generation", "key": "ai-use-case:phishing-and-lure-generation" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Forecast or prediction", "key": "evidence-landscape:forecast-or-prediction" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Provider abuse telemetry", "key": "evidence-landscape:provider-abuse-telemetry" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Blast Radius", "type": "metric", "value": "832 accounts · medium confidence", "key": "metric:832-accounts-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "33% · medium confidence", "key": "metric:33-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "56% · medium confidence", "key": "metric:56-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "6.5% · medium confidence", "key": "metric:6.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "67.3% · medium confidence", "key": "metric:67.3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8.6% · medium confidence", "key": "metric:8.6-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "8.9% · medium confidence", "key": "metric:8.9-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Espionage", "key": "impact:espionage" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "LLM model", "type": "llm_model", "value": "Claude", "key": "llm-model:claude" }, { "facet": "LLM provider", "type": "llm_provider", "value": "Anthropic", "key": "llm-provider:anthropic" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Exfiltration", "key": "mitre-tactic:exfiltration" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Lateral Movement", "key": "mitre-tactic:lateral-movement" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Privilege Escalation", "key": "mitre-tactic:privilege-escalation" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Publisher Verified Override", "key": "publication-date-method:publisher-verified-override" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "Anthropic", "key": "publisher:anthropic" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "anthropic.com", "key": "publisher-domain:anthropic.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "AI misuse, abuse-disruption, or threat research report", "key": "relevance-basis:ai-misuse-abuse-disruption-or-threat-research-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Sector", "type": "sector", "value": "Financial Services", "key": "sector:financial-services" }, { "facet": "Sector", "type": "sector", "value": "Government", "key": "sector:government" }, { "facet": "Source type", "type": "source_type", "value": "provider or government report", "key": "source-type:provider-or-government-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "incident_or_observation", "key": "statistical-use:incident-or-observation" }, { "facet": "Target", "type": "target", "value": "Consumers or individuals", "key": "target:consumers-or-individuals" }, { "facet": "Target", "type": "target", "value": "Developers", "key": "target:developers" }, { "facet": "TTP", "type": "ttp", "value": "Data exfiltration", "key": "ttp:data-exfiltration" }, { "facet": "Used by content type", "type": "used_by_type", "value": "research", "key": "used-by-type:research" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" }, { "facet": "Year", "type": "year", "value": "2026", "key": "year:2026" } ], "used_in": [ { "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "type": "research", "domain": "threat-intelligence" } ] }, { "id": "site-reference:trumpwhitehouse.archives.gov:e5850b60de11a784", "title": "White House, Statement from the Press Secretary", "description": "External source cited by 1 maintained 1200km page.", "url": "https://trumpwhitehouse.archives.gov/briefings-statements/statement-press-secretary-25", "publisher": "Trumpwhitehouse Archives", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "trumpwhitehouse.archives.gov", "key": "publisher-domain:trumpwhitehouse.archives.gov" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:learn.microsoft.com:8ca5432897dc6874", "title": "Windows API documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://learn.microsoft.com/windows/win32/api", "publisher": "Learn Microsoft", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "learn.microsoft.com", "key": "publisher-domain:learn.microsoft.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:raw.githubusercontent.com:fa89ea06e0f5363d", "title": "windows-security/DC01-security.jsonl", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/windows-security/DC01-security.jsonl", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:raw.githubusercontent.com:4b7a0a5aac76d3b0", "title": "windows-security/SERVER-RD-02-security.jsonl", "description": "External source cited by 1 maintained 1200km page.", "url": "https://raw.githubusercontent.com/anpa1200/CTI_as_a_Code/main/investigations/lifetech-2024-11/01-evidence/windows-security/SERVER-RD-02-security.jsonl", "publisher": "RAW Githubusercontent", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "raw.githubusercontent.com", "key": "publisher-domain:raw.githubusercontent.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:wiz.io:5557b4f26dd2282a", "title": "Wiz Research, Three’s a Crowd: TeamPCP trojanizes LiteLLM", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign", "publisher": "WIZ", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "wiz.io", "key": "publisher-domain:wiz.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "type": "article", "domain": "offensive-research" } ] }, { "id": "site-reference:govinfo.library.unt.edu:3d3a99647e2c717f", "title": "WMD Commission report index", "description": "External source cited by 1 maintained 1200km page.", "url": "https://govinfo.library.unt.edu/wmd/report/index.html", "publisher": "Govinfo Library UNT", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "govinfo.library.unt.edu", "key": "publisher-domain:govinfo.library.unt.edu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:govinfo.library.unt.edu:8e04750f095f7e86", "title": "WMD Commission transmittal letter", "description": "External source cited by 1 maintained 1200km page.", "url": "https://govinfo.library.unt.edu/wmd/report/transmittal_letter.html", "publisher": "Govinfo Library UNT", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "govinfo.library.unt.edu", "key": "publisher-domain:govinfo.library.unt.edu" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:huggingface.co:3adfaaf002f938a6", "title": "Writing a chat template", "description": "External source cited by 1 maintained 1200km page.", "url": "https://huggingface.co/docs/transformers/main/chat_templating_writing", "publisher": "Huggingface", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "huggingface.co", "key": "publisher-domain:huggingface.co" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "ai-security", "key": "used-by-topic:ai-security" } ], "used_in": [ { "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "type": "article", "domain": "ai-security" } ] }, { "id": "ai-attack-reference:pub-075", "title": "X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon | IBM", "description": "IBM X-Force threat-research report covering Credential theft and Generative AI.", "url": "https://www.ibm.com/think/x-force/2024-x-force-threat-intelligence-index", "publisher": "IBM X-Force", "published_at": "2025-04-02", "inclusion": "core", "tags": [ { "facet": "AI relevance", "type": "ai_relevance", "value": "core_ai_attack", "key": "ai-relevance:core-ai-attack" }, { "facet": "AI technology", "type": "ai_technology", "value": "Generative AI", "key": "ai-technology:generative-ai" }, { "facet": "Data type", "type": "data_type", "value": "Credentials and passwords", "key": "data-type:credentials-and-passwords" }, { "facet": "Data type", "type": "data_type", "value": "Documents and files", "key": "data-type:documents-and-files" }, { "facet": "Evidence inventory", "type": "evidence_inventory", "value": "Contains extracted metrics", "key": "evidence-inventory:contains-extracted-metrics" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Incident response", "key": "evidence-landscape:incident-response" }, { "facet": "Evidence landscape", "type": "evidence_landscape", "value": "Underground-market observation", "key": "evidence-landscape:underground-market-observation" }, { "facet": "Evidence quality", "type": "content_quality", "value": "Usable Machine Extraction", "key": "content-quality:usable-machine-extraction" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "100% · medium confidence", "key": "metric:100-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "11.5% · medium confidence", "key": "metric:11.5-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "20% · medium confidence", "key": "metric:20-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "266% · medium confidence", "key": "metric:266-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "3% · medium confidence", "key": "metric:3-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "30% · medium confidence", "key": "metric:30-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "44% · medium confidence", "key": "metric:44-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "50% · medium confidence", "key": "metric:50-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "56% · medium confidence", "key": "metric:56-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "71% · medium confidence", "key": "metric:71-medium-confidence" }, { "facet": "Extracted metric · Percentage", "type": "metric", "value": "72% · medium confidence", "key": "metric:72-medium-confidence" }, { "facet": "Impact", "type": "impact", "value": "Credential compromise", "key": "impact:credential-compromise" }, { "facet": "Impact", "type": "impact", "value": "Data theft or exfiltration", "key": "impact:data-theft-or-exfiltration" }, { "facet": "Impact", "type": "impact", "value": "Ransomware or extortion", "key": "impact:ransomware-or-extortion" }, { "facet": "Inclusion", "type": "inclusion", "value": "Core AI-attack research", "key": "inclusion:core-ai-attack-research" }, { "facet": "Infrastructure", "type": "infrastructure", "value": "Browser", "key": "infrastructure:browser" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Actions on Objectives", "key": "kill-chain-phase:actions-on-objectives" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Delivery", "key": "kill-chain-phase:delivery" }, { "facet": "Kill Chain phase", "type": "kill_chain_phase", "value": "Exploitation", "key": "kill-chain-phase:exploitation" }, { "facet": "Malware or tool", "type": "malware_or_tool", "value": "CL0P ransomware", "key": "malware-or-tool:cl0p-ransomware" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Discovery", "key": "mitre-tactic:discovery" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Impact", "key": "mitre-tactic:impact" }, { "facet": "MITRE tactic", "type": "mitre_tactic", "value": "Initial Access", "key": "mitre-tactic:initial-access" }, { "facet": "Publication date method", "type": "publication_date_method", "value": "Metadata", "key": "publication-date-method:metadata" }, { "facet": "Publication date precision", "type": "publication_date_precision", "value": "Day", "key": "publication-date-precision:day" }, { "facet": "Publisher", "type": "publisher", "value": "IBM X-Force", "key": "publisher:ibm-x-force" }, { "facet": "Publisher domain", "type": "publisher_domain", "value": "ibm.com", "key": "publisher-domain:ibm.com" }, { "facet": "Relevance basis", "type": "relevance_basis", "value": "threat landscape, incident-response, or CTI report", "key": "relevance-basis:threat-landscape-incident-response-or-cti-report" }, { "facet": "Retrieval method", "type": "retrieval_method", "value": "Direct", "key": "retrieval-method:direct" }, { "facet": "Review requirement", "type": "review_requirement", "value": "Manual review required", "key": "review-requirement:manual-review-required" }, { "facet": "Source type", "type": "source_type", "value": "threat-research report", "key": "source-type:threat-research-report" }, { "facet": "Statistical use", "type": "statistical_use", "value": "context_or_observation", "key": "statistical-use:context-or-observation" }, { "facet": "Target", "type": "target", "value": "Executives", "key": "target:executives" }, { "facet": "TTP", "type": "ttp", "value": "Credential theft", "key": "ttp:credential-theft" }, { "facet": "Year", "type": "year", "value": "2025", "key": "year:2025" } ], "used_in": [] }, { "id": "site-reference:virustotal.github.io:a5bc338311633bf4", "title": "YARA", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://virustotal.github.io/yara", "publisher": "Virustotal Github", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "virustotal.github.io", "key": "publisher-domain:virustotal.github.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "type": "guide", "domain": "threat-intelligence" } ] }, { "id": "site-reference:yara.readthedocs.io:7f22aec02bbf978f", "title": "YARA 4.5 documentation", "description": "External source cited by 2 maintained 1200km pages.", "url": "https://yara.readthedocs.io/en/latest", "publisher": "YARA Readthedocs", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "yara.readthedocs.io", "key": "publisher-domain:yara.readthedocs.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "documentation", "key": "used-by-type:documentation" }, { "facet": "Used by content type", "type": "used_by_type", "value": "guide", "key": "used-by-type:guide" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "malware-analysis", "key": "used-by-topic:malware-analysis" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "platform-documentation", "key": "used-by-topic:platform-documentation" } ], "used_in": [ { "title": "Cyber Knowledge Source Index", "url": "https://1200km.com/cyber-knowledge/sources/", "type": "documentation", "domain": "platform-documentation" }, { "title": "Malware Analysis & Reverse Engineering", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "type": "guide", "domain": "malware-analysis" } ] }, { "id": "site-reference:yara.readthedocs.io:507d522cdc0aa2e6", "title": "YARA documentation", "description": "External source cited by 1 maintained 1200km page.", "url": "https://yara.readthedocs.io", "publisher": "YARA Readthedocs", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "yara.readthedocs.io", "key": "publisher-domain:yara.readthedocs.io" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "network-security", "key": "used-by-topic:network-security" } ], "used_in": [ { "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "type": "article", "domain": "network-security" } ] }, { "id": "site-reference:cloud.google.com:975c6a77f42adf72", "title": "YARA-L 2.0 Language Syntax | Google Security Operations | Google Cloud", "description": "External source cited by 1 maintained 1200km page.", "url": "https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax", "publisher": "Cloud Google", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "cloud.google.com", "key": "publisher-domain:cloud.google.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "detection-engineering", "key": "used-by-topic:detection-engineering" } ], "used_in": [ { "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "type": "article", "domain": "detection-engineering" } ] }, { "id": "site-reference:immersivelabs.com:fd3a123669d2d663", "title": "ZEROLOT Analysis: Inside Sandworm's Destructive New Wiper *This blog post is a technical analysis of the ZEROLOT malware, examining its internal mechanics and destructive…*www.immersivelabs.com", "description": "External source cited by 1 maintained 1200km page.", "url": "https://www.immersivelabs.com/resources/c7-blog/zerolot-analysis-inside-sandworms-destructive-new-wiper", "publisher": "Immersivelabs", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "immersivelabs.com", "key": "publisher-domain:immersivelabs.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "threat-intelligence", "key": "used-by-topic:threat-intelligence" } ], "used_in": [ { "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "type": "article", "domain": "threat-intelligence" } ] }, { "id": "site-reference:docs.ollama.com:043ee5baa4f46a89", "title": "אולמה", "description": "External source cited by 1 maintained 1200km page.", "url": "https://docs.ollama.com/faq", "publisher": "DOCS Ollama", "published_at": null, "inclusion": "site", "tags": [ { "facet": "Publisher domain", "type": "publisher_domain", "value": "docs.ollama.com", "key": "publisher-domain:docs.ollama.com" }, { "facet": "Used by content type", "type": "used_by_type", "value": "article", "key": "used-by-type:article" }, { "facet": "Used by topic", "type": "used_by_topic", "value": "offensive-research", "key": "used-by-topic:offensive-research" } ], "used_in": [ { "title": "HexStrike MCP Orchestration with Ollama: Ubuntu Host, Kali VM, SSH Bridging, and Performance…", "url": "https://1200km.com/articles/read/2025/2025-12-31-hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596/", "type": "article", "domain": "offensive-research" } ] } ] }