Collect IoCs

{
	"objects": [
		{
			"type": "report",
			"spec_version": "2.1",
			"id": "grouping--e10219e8-edf9-46f5-ab1a-2dc84f74ac8b",
			"created": "2022-02-11T08:08:01.131733Z",
			"modified": "2022-02-11T08:08:01.131733Z",
			"name": "Threat actor groups are targeting VMware Horizon servers running versions affected by Log4Shell vulnerabilities…",
			"description": "• Post exploitation, the threat actors use encoded PowerShell commands to download a second-stage payload (such as Cobalt Strike beacons, Crypto miner or ransomware) to the victim systems. Use the PowerShell command to detect malicious file modification activity.",
			"context": "unspecified",
			"object_refs": [
				"malware--1a1d3ea4-972e-4c48-8d85-08d9db8f1550",
				"attack-pattern--7385dfaf-6886-4229-9ecd-6fd678040830",
				"domain-name--cb403063-a319-5b81-8160-b3f04cb6b9a9",
				"url--a97b9642-9c68-5bc0-97a4-6488a7a06d58",
				"ipv4-addr--34fc35a8-b548-5083-ace8-6d65bcfce5d7"
			],
			"external_references": [
				{
					"source_name": "Feedly article",
					"url": "https://feedly.com/i/entry/lpNdEKDz4G+795+TnrSpAd6SUK5+88ulJrCUUbPk/6I=_17ee7d2facc:14ddcbb:aa31659c"
				},
				{
					"source_name": "Checkmate",
					"url": "https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/"
				}
			]
		},
		{
			"type": "malware",
			"spec_version": "2.1",
			"id": "malware--1a1d3ea4-972e-4c48-8d85-08d9db8f1550",
			"created": "2022-02-10T20:30:40.279281Z",
			"modified": "2022-02-10T20:30:40.279281Z",
			"name": "Cobalt Strike",
			"description": "Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine.",
			"is_family": true,
			"aliases": [
				"Agentemis",
				"BEACON",
				"CobaltStrike"
			],
			"external_references": [
				{
					"source_name": "",
					"url": "http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems"
				}
			]
		},
		{
			"type": "attack-pattern",
			"id": "attack-pattern--2e34237d-8574-43f6-aace-ae2915de8597",
			"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
			"created": "2020-03-02T19:05:18.137Z",
			"modified": "2021-04-01T16:21:17.553Z",
			"name": "Spearphishing Attachment",
			"description": "Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.",
			"kill_chain_phases": [
				{
					"kill_chain_name": "mitre-attack",
					"phase_name": "initial-access"
				}
			],
			"external_references": [
				{
					"source_name": "mitre-attack",
					"url": "https://attack.mitre.org/techniques/T1566/001",
					"external_id": "T1566.001"
				}
			],
			"object_marking_refs": [
				"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
			],
			"x_mitre_contributors": [
				"Philip Winther"
			],
			"x_mitre_data_sources": [
				"Application Log: Application Log Content",
				"Network Traffic: Network Traffic Content",
				"Network Traffic: Network Traffic Flow"
			],
			"x_mitre_is_subtechnique": true,
			"x_mitre_platforms": [
				"macOS",
				"Windows",
				"Linux"
			],
			"x_mitre_version": "2.1"
		},
		{
			"type": "domain-name",
			"spec_version": "2.1",
			"id": "domain-name--cb403063-a319-5b81-8160-b3f04cb6b9a9",
			"value": "b.oracleservice.top"
		},
		{
			"type": "url",
			"spec_version": "2.1",
			"id": "url--2c87a8fc-9c0b-56e4-ba7f-96f09ab8cb77",
			"value": "http://149.28.200.140:443/winntaa.exe"
		},
		{
			"type": "ipv4-addr",
			"spec_version": "2.1",
			"id": "ipv4-addr--34fc35a8-b548-5083-ace8-6d65bcfce5d7",
			"value": "140.246.171.141"
		},
		{
			"type": "indicator",
			"spec_version": "2.1",
			"id": "indicator--3a715b14-5d82-499f-b0a2-86b7444745da",
			"created": "2022-02-10T14:00:29.171064Z",
			"modified": "2022-02-10T14:00:29.171064Z",
			"name": "Hash",
			"pattern": "[file:hashes.MD5 = '29bc15a6f0ff99084e986c3e6ab1208c']",
			"pattern_type": "stix",
			"pattern_version": "2.1",
			"valid_from": "2022-02-10T14:00:29.171064Z"
		}
	],
	"id": "bundle--2cd2674c-f6e1-49b0-a714-6d5f2dc87ceb",
	"type": "bundle"
}