{
  "Event": {
    "analysis": "1",
    "date": "2026-04-28",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-28",
    "publish_timestamp": "1777385249",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1777385249",
    "uuid": "234a16f3-81b8-4d63-bfec-3918de7d64a3",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-28T04:06:17.771854+00:00",
        "timestamp": "1777349180",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1c888aa2-2040-44be-8e4f-b1c1ef63a824",
        "value": "57.154.243.43",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-28T04:11:23.782275+00:00",
        "timestamp": "1777349486",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5c831516-c63f-4169-b108-2e292633bf7f",
        "value": "5.255.102.136",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-28T05:25:54.031320+00:00",
        "timestamp": "1777353956",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "94f9f6c8-1907-4aa1-be1d-b3003c4b0acb",
        "value": "64.62.197.227",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER Possible SQLi Attempt in User Agent (Inbound)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-28T05:42:25.127733+00:00",
        "timestamp": "1777354946",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ac9af648-6e5c-41c7-861f-961b4e16c27b",
        "value": "2a03:cfc0:8000:2e::9532:7419",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-28T07:40:24.394660+00:00",
        "timestamp": "1777362026",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "995efc1e-669a-4281-a416-95fbbc6480e6",
        "value": "185.177.72.16",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-28T08:41:27.722368+00:00",
        "timestamp": "1777365689",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7641c068-bf6c-4d07-a205-ad744e9bcdc4",
        "value": "145.223.45.151",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-28T08:48:09.527740+00:00",
        "timestamp": "1777366090",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0254363b-0620-4867-89fb-e6b0e1b62227",
        "value": "94.177.49.254",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GPL WEB_SERVER .htpasswd access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-28T10:14:06.367104+00:00",
        "timestamp": "1777371248",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "74dcc715-66c1-4291-b388-443c4973d0be",
        "value": "195.178.110.101",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "TGI HUNT Curl to Bare IP Address",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-28T14:07:27.112346+00:00",
        "timestamp": "1777385249",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0f7d8188-67da-4c0a-ab4a-ee12e7122bd9",
        "value": "47.84.138.195",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}