{
  "Event": {
    "analysis": "1",
    "date": "2026-03-19",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-03-19",
    "publish_timestamp": "1773951313",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1773951312",
    "uuid": "fae52194-82fe-4f1b-9569-81228fb53d04",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T04:18:30.492844+00:00",
        "timestamp": "1773893912",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "489e8ef2-b1f9-49a7-b5f4-d5318a31be4b",
        "value": "2001:470:1:332::a",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:42:41.525600+00:00",
        "timestamp": "1773906163",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ae418d5d-95d5-4569-8505-fe1cc0c82114",
        "value": "162.158.94.111",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:42:48.721692+00:00",
        "timestamp": "1773906170",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a30c4135-b6a4-4922-90af-b7da6c7b6825",
        "value": "162.158.95.182",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:42:52.257181+00:00",
        "timestamp": "1773906174",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4821bfb7-326a-44cc-8596-47f1c86af121",
        "value": "162.158.94.119",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:42:56.173654+00:00",
        "timestamp": "1773906177",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "48203f55-c90d-4336-a8d3-8733da1e3c51",
        "value": "162.158.94.118",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:42:59.929852+00:00",
        "timestamp": "1773906181",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3e934c3d-bf23-42bd-a7ca-469e1077b1ca",
        "value": "162.158.95.181",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:43:55.162886+00:00",
        "timestamp": "1773906236",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4a5700ee-7bb6-42b5-8261-51e262cfbe9a",
        "value": "162.158.94.110",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:44:52.308494+00:00",
        "timestamp": "1773906293",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ec71ce61-806b-41a9-8e71-6c9ff37646d2",
        "value": "141.101.98.164",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:45:09.858869+00:00",
        "timestamp": "1773906311",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "fafda261-6af2-4215-8d5b-0585c8b747db",
        "value": "141.101.98.227",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:46:09.890923+00:00",
        "timestamp": "1773906371",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "991dc132-d808-4f6d-b31c-867755bf3182",
        "value": "162.158.95.251",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:46:13.235736+00:00",
        "timestamp": "1773906374",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "526e4800-cc37-4fb4-97e0-d81342cbf04a",
        "value": "162.158.95.252",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:46:16.975753+00:00",
        "timestamp": "1773906378",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0434be66-37f9-46ba-a2d2-0711aff6cc32",
        "value": "172.68.193.149",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:46:20.415659+00:00",
        "timestamp": "1773906381",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "07d38d7a-64fe-4602-8580-81be5385e3a8",
        "value": "172.68.193.148",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T07:46:23.966651+00:00",
        "timestamp": "1773906385",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "eefa1f9a-3f5a-4929-8b47-a4ce1e77d0fa",
        "value": "162.158.94.204",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T10:54:47.018920+00:00",
        "timestamp": "1773917688",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2fc35723-af3c-4f57-93e9-f8d37699fb50",
        "value": "74.249.80.87",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T13:00:15.949775+00:00",
        "timestamp": "1773925221",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6880b0c6-9ab7-40e0-93ab-f2901d1fcc1f",
        "value": "34.88.75.53",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T17:45:08.212087+00:00",
        "timestamp": "1773942309",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "01056096-b191-4735-b370-47ece071681f",
        "value": "46.224.106.161",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T19:35:26.576656+00:00",
        "timestamp": "1773948928",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "78d6ac83-3fdf-456b-adff-0166850264a7",
        "value": "2a00:5da0:1:201::305",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-19T20:15:11.144258+00:00",
        "timestamp": "1773951312",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5b7c02d8-711e-4b3c-b510-5e3928a0751d",
        "value": "40.113.19.56",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}