{
  "Event": {
    "analysis": "1",
    "date": "2026-03-07",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-03-07",
    "publish_timestamp": "1772914090",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1772914090",
    "uuid": "87a2315c-9fa4-4086-937c-cda9d4c37070",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-07T00:50:48.213248+00:00",
        "timestamp": "1772844649",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c0c29cd9-9799-4493-afa1-0a4791be70d3",
        "value": "2001:470:1:332::28",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-07T04:29:13.944518+00:00",
        "timestamp": "1772857755",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e56569fb-6fe3-4b71-ad05-bd67bab63cb6",
        "value": "2001:470:1:c84::26",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-07T06:17:33.573318+00:00",
        "timestamp": "1772864255",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f3133567-c3f0-4086-aded-d94534ab8d01",
        "value": "34.142.251.255",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-07T08:30:33.334936+00:00",
        "timestamp": "1772872234",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "eeb88baa-495e-494b-baf5-da269c30892e",
        "value": "20.63.210.169",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-07T08:39:25.407515+00:00",
        "timestamp": "1772872766",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7857b478-72dc-42ab-b7db-f64e863ce1cb",
        "value": "54.171.253.96",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "TGI HUNT gitrepo HTTP Probe",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-07T10:55:34.404439+00:00",
        "timestamp": "1772880936",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "70f94dfa-9336-480e-99a3-4e667496aae2",
        "value": "31.59.107.12",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-07T20:08:08.587405+00:00",
        "timestamp": "1772914090",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8f3b7e02-2280-4bc8-b48e-9796763aa2fb",
        "value": "4.204.200.32",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}