{
  "Event": {
    "analysis": "1",
    "date": "2026-07-27",
    "extends_uuid": "",
    "info": "[Threat Intel] AI-Native security platform",
    "protected": false,
    "publish_timestamp": "1785616368",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1785616367",
    "uuid": "97084bf6-b5fa-4f23-9990-bbad9ba446a2",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#150050",
        "local": false,
        "name": "rectifyq:sub-category=\"report\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ceae8c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"/etc/passwd and /etc/shadow - T1003.008\"",
        "relationship_type": ""
      },
      {
        "colour": "#4cb5c3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deploy Container - T1610\"",
        "relationship_type": ""
      },
      {
        "colour": "#d0c0c7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Escape to Host - T1611\"",
        "relationship_type": ""
      },
      {
        "colour": "#ecc598",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH Authorized Keys - T1098.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Secrets Management Stores - T1555.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Service Hijacking - T1496.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#3500cd",
        "local": false,
        "name": "rectifyq:detection-rules=\"sigma-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785236411",
        "to_ids": false,
        "type": "link",
        "uuid": "0cd3e98f-e5cd-4514-b911-bd0d5d2352dd",
        "value": "https://beelzebub.ai/blog/it-thought-it-had-won/",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785236411",
        "to_ids": false,
        "type": "text",
        "uuid": "c559caac-97a7-4ea0-b4db-8b275b8cea94",
        "value": "Between May and July 2026, security researchers deployed an unauthenticated Model Context Protocol (MCP) honeypot server to observe how threat actors exploit AI agent infrastructure. Of approximately 1,000 sources that reached the decoy, 596 spoke the protocol and 24 proceeded to actively exploit it. These operators executed 628 shell commands, 255 file reads, and 248 secrets-store lookups, with 19 hunting credentials and 4 attempting container escapes. Activity escalated from 39 tool calls in May to 877 by mid-July. Three stolen credentials were subsequently used against a live AWS account, with two cases involving Bedrock model invocation for LLMjacking. The attacks demonstrated automated reconnaissance, credential harvesting, container escape attempts, backdoor account creation, and Kubernetes enumeration, revealing that exposed MCP servers represent a growing attack surface as AI agent infrastructure proliferates."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785236411",
        "to_ids": false,
        "type": "text",
        "uuid": "cc5d5f41-da22-446b-ad9b-99be8c8fad40",
        "value": "Name: AI-Native security platform\nAuthor: AlienVault\nAdversary: \nTags: [\"kubernetes\", \"honeypot\", \"container escape\", \"mcp\", \"ai agent security\", \"llmjacking\", \"aws bedrock\", \"credential theft\", \"model context protocol\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602847",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "92f1ed4f-3668-4798-ab85-d21ef3f587cb",
        "value": "115.84.87.150",
        "Tag": [
          {
            "colour": "#bb4bca",
            "local": false,
            "name": "asn:asn=\"9873\"",
            "relationship_type": ""
          },
          {
            "colour": "#1af1aa",
            "local": false,
            "name": "asn:as-owner=\"TELECOM-LA-AS-AP Lao Telecom Communication, LTC\"",
            "relationship_type": ""
          },
          {
            "colour": "#04aa1d",
            "local": false,
            "name": "asn:as-country=\"LA\"",
            "relationship_type": ""
          },
          {
            "colour": "#8038b5",
            "local": false,
            "name": "misp-galaxy:country=\"laos\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602868",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "372d1421-3d68-47bb-8b1f-7e7a4a5c4845",
        "value": "23.27.175.241",
        "Tag": [
          {
            "colour": "#14d0ec",
            "local": false,
            "name": "asn:asn=\"149440\"",
            "relationship_type": ""
          },
          {
            "colour": "#1b81cb",
            "local": false,
            "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"",
            "relationship_type": ""
          },
          {
            "colour": "#12ee4d",
            "local": false,
            "name": "asn:as-country=\"MY\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"malaysia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602889",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5aab1469-b9ff-4588-9f51-07b3abc497d6",
        "value": "102.210.28.96",
        "Tag": [
          {
            "colour": "#bec97a",
            "local": false,
            "name": "asn:asn=\"329014\"",
            "relationship_type": ""
          },
          {
            "colour": "#d2b5f5",
            "local": false,
            "name": "asn:as-owner=\"Vilcom-Networks\"",
            "relationship_type": ""
          },
          {
            "colour": "#d436d5",
            "local": false,
            "name": "asn:as-country=\"KE\"",
            "relationship_type": ""
          },
          {
            "colour": "#16599a",
            "local": false,
            "name": "misp-galaxy:country=\"kenya\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602910",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "22b5598b-d0d2-4dcc-a0c6-0e43a5a725ee",
        "value": "103.151.172.25",
        "Tag": [
          {
            "colour": "#2779b5",
            "local": false,
            "name": "asn:asn=\"134972\"",
            "relationship_type": ""
          },
          {
            "colour": "#ed5dea",
            "local": false,
            "name": "asn:as-owner=\"IKUUU-AS-AP IKUUU NETWORK LTD\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602932",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8f2321be-87be-4210-8ba4-b27f22eefcce",
        "value": "108.80.112.16",
        "Tag": [
          {
            "colour": "#6dc194",
            "local": false,
            "name": "asn:asn=\"7018\"",
            "relationship_type": ""
          },
          {
            "colour": "#f71a75",
            "local": false,
            "name": "asn:as-owner=\"ATT-INTERNET4\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602953",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ec181b12-a06d-4107-b282-1d821047802d",
        "value": "115.84.114.84",
        "Tag": [
          {
            "colour": "#bb4bca",
            "local": false,
            "name": "asn:asn=\"9873\"",
            "relationship_type": ""
          },
          {
            "colour": "#1af1aa",
            "local": false,
            "name": "asn:as-owner=\"TELECOM-LA-AS-AP Lao Telecom Communication, LTC\"",
            "relationship_type": ""
          },
          {
            "colour": "#04aa1d",
            "local": false,
            "name": "asn:as-country=\"LA\"",
            "relationship_type": ""
          },
          {
            "colour": "#8038b5",
            "local": false,
            "name": "misp-galaxy:country=\"laos\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602974",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "53af1740-0d11-4cd3-bffc-f3317a95ad3f",
        "value": "152.55.176.13",
        "Tag": [
          {
            "colour": "#ca67ea",
            "local": false,
            "name": "asn:asn=\"81\"",
            "relationship_type": ""
          },
          {
            "colour": "#759b85",
            "local": false,
            "name": "asn:as-owner=\"NCREN\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602995",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e2acda56-b745-4217-9fa2-935f6a171b21",
        "value": "222.247.231.147",
        "Tag": [
          {
            "colour": "#9ef9a4",
            "local": false,
            "name": "asn:asn=\"4134\"",
            "relationship_type": ""
          },
          {
            "colour": "#2f9c31",
            "local": false,
            "name": "asn:as-owner=\"CHINANET-BACKBONE No.31,Jin-rong Street\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603016",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "87133de6-9e65-479f-b6ed-d4d04b67ac87",
        "value": "39.162.24.20",
        "Tag": [
          {
            "colour": "#5cc23a",
            "local": false,
            "name": "asn:asn=\"24445\"",
            "relationship_type": ""
          },
          {
            "colour": "#67a63a",
            "local": false,
            "name": "asn:as-owner=\"CMNET-V4HENAN-AS-AP Henan Mobile Communications Co.,Ltd\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603037",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9b4a3960-6b51-44fd-b730-bd41919593cf",
        "value": "91.209.48.146",
        "Tag": [
          {
            "colour": "#ba7adf",
            "local": false,
            "name": "asn:asn=\"4637\"",
            "relationship_type": ""
          },
          {
            "colour": "#721a4b",
            "local": false,
            "name": "asn:as-owner=\"ASN-TELSTRA-GLOBAL Telstra Global\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...W 228 credential hunt \u00b7 honeytoken fire (Bedrock) 34.177.101[.]32 Google Cloud SG 222 credential hunt \u00b7 container e...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603058",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "98b3609d-da33-476d-9b8d-d96146f6853f",
        "value": "34.177.101.32",
        "Tag": [
          {
            "colour": "#661a1f",
            "local": false,
            "name": "asn:asn=\"396982\"",
            "relationship_type": ""
          },
          {
            "colour": "#b21243",
            "local": false,
            "name": "asn:as-owner=\"GOOGLE-CLOUD-PLATFORM\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...115.84.114[.]84 Lao Telecom LA 83 credential hunt 107.151.158[.]11 Zenlayer US 65 full chain \u00b7 escape \u00b7 backdoor + S...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603079",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b5c9c779-0c29-4749-bc71-52a4b9d22f24",
        "value": "107.151.158.11",
        "Tag": [
          {
            "colour": "#cf05b0",
            "local": false,
            "name": "asn:asn=\"21859\"",
            "relationship_type": ""
          },
          {
            "colour": "#5e9494",
            "local": false,
            "name": "asn:as-owner=\"ZEN-ECN\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...er US 65 full chain \u00b7 escape \u00b7 backdoor + SSH key 87.249.134[.]130 Datacamp US 57 credential hunt \u00b7 container escape...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603101",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "38b76d16-3f02-43a6-bdd0-d701e607151d",
        "value": "87.249.134.130",
        "Tag": [
          {
            "colour": "#15dbfe",
            "local": false,
            "name": "asn:asn=\"212238\"",
            "relationship_type": ""
          },
          {
            "colour": "#1f1556",
            "local": false,
            "name": "asn:as-owner=\"CDNEXT\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...Datacamp US 57 credential hunt \u00b7 container escape 91.107.153[.]250 Hetzner DE 39 credential hunt 35.222.46[.]242 Goo...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603122",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c591244a-875f-4247-a051-c651c016aca9",
        "value": "91.107.153.250",
        "Tag": [
          {
            "colour": "#d17f93",
            "local": false,
            "name": "asn:asn=\"24940\"",
            "relationship_type": ""
          },
          {
            "colour": "#18e065",
            "local": false,
            "name": "asn:as-owner=\"HETZNER-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...pe 91.107.153[.]250 Hetzner DE 39 credential hunt 35.222.46[.]242 Google Cloud US 30 credential hunt 51.195.191[.]8...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603143",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "74cba673-88a7-4679-b207-1486b0475e5c",
        "value": "35.222.46.242",
        "Tag": [
          {
            "colour": "#661a1f",
            "local": false,
            "name": "asn:asn=\"396982\"",
            "relationship_type": ""
          },
          {
            "colour": "#b21243",
            "local": false,
            "name": "asn:as-owner=\"GOOGLE-CLOUD-PLATFORM\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...5.222.46[.]242 Google Cloud US 30 credential hunt 51.195.191[.]88 OVH FR 28 credential hunt 103.151.172[.]25 KIDC H...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603164",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "50c25531-476a-4c2e-a60f-33c21e50da66",
        "value": "51.195.191.88",
        "Tag": [
          {
            "colour": "#21ca95",
            "local": false,
            "name": "asn:asn=\"16276\"",
            "relationship_type": ""
          },
          {
            "colour": "#983aa5",
            "local": false,
            "name": "asn:as-owner=\"OVH\"",
            "relationship_type": ""
          },
          {
            "colour": "#93736f",
            "local": false,
            "name": "asn:as-country=\"FR\"",
            "relationship_type": ""
          },
          {
            "colour": "#f6cea1",
            "local": false,
            "name": "misp-galaxy:country=\"france\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...recon) 108.80.112[.]16 AT&T US 16 credential hunt 18.144.48[.]123 Amazon US 11 credential hunt 64.227.57[.]91 Digit...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603185",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "163be2fd-f6cc-406c-bd25-0aac68a39a8d",
        "value": "18.144.48.123",
        "Tag": [
          {
            "colour": "#4745f2",
            "local": false,
            "name": "asn:asn=\"16509\"",
            "relationship_type": ""
          },
          {
            "colour": "#5424ef",
            "local": false,
            "name": "asn:as-owner=\"AMAZON-02\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...hunt 18.144.48[.]123 Amazon US 11 credential hunt 64.227.57[.]91 DigitalOcean US 9 credential hunt 39.162.24[.]20...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603206",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c3b1a025-511d-4389-b8ea-79bd1a6edbcf",
        "value": "64.227.57.91",
        "Tag": [
          {
            "colour": "#c2074e",
            "local": false,
            "name": "asn:asn=\"14061\"",
            "relationship_type": ""
          },
          {
            "colour": "#d7952a",
            "local": false,
            "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...39.162.24[.]20 Henan Mobile CN 9 credential hunt 139.59.226[.]65 DigitalOcean SG 3 honeytoken fire (Bedrock) Five...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603227",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "96414a2e-475d-44a9-a661-746b1ad4d5fa",
        "value": "139.59.226.65",
        "Tag": [
          {
            "colour": "#c2074e",
            "local": false,
            "name": "asn:asn=\"14061\"",
            "relationship_type": ""
          },
          {
            "colour": "#d7952a",
            "local": false,
            "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a Sigma rule (or a Sigma rule name).",
        "meta-category": "misc",
        "name": "sigma",
        "template_uuid": "aa21a3cd-ab2c-442a-9999-a5e6626591ec",
        "template_version": "2",
        "timestamp": "1785599593",
        "uuid": "2b4ed147-d1a1-419c-8a6f-29e0ecbb55dd",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sigma-rule-name",
            "timestamp": "1785599593",
            "to_ids": false,
            "type": "text",
            "uuid": "9e7987a0-bd8c-4933-9677-ecea7d7e931d",
            "value": "MCP Tool Call Reading A Credential File"
          },
          {
            "category": "Payload installation",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sigma",
            "timestamp": "1785599593",
            "to_ids": true,
            "type": "sigma",
            "uuid": "eb2645ca-3839-4ae7-931c-229b5766cad6",
            "value": "title: MCP Tool Call Reading A Credential File\r\nid: cbe4124b-f0c5-45d1-beaf-c10dcdc8807d\r\nstatus: experimental\r\nlogsource:\r\n    product: mcp_server\r\n    service: tool_audit          # CUSTOM/NON-STANDARD \u2014 map to your audit schema\r\ndetection:\r\n    selection_tool:\r\n        tool_name:\r\n            - 'execute_command'\r\n            - 'read_file'\r\n    selection_target:\r\n        tool_arguments|contains:\r\n            - '/etc/shadow'\r\n            - '/etc/passwd'\r\n            - '.aws/credentials'\r\n            - '.env'\r\n    condition: selection_tool and selection_target\r\nfalsepositives:\r\n    - A first-party agent that legitimately reads these paths. If yours does, it\r\n      belongs in an allowlist, not an alert.\r\nlevel: high\r\ntags: [attack.credential-access, attack.t1552.001]"
          }
        ]
      }
    ]
  }
}