The source of everything: digital forensic examination of incidents involving source code leaks
Tags
| attack-pattern: | Data Direct Credentials - T1589.001 Password Guessing - T1110.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 Vulnerabilities - T1588.006 |
Common Information
| Type | Value |
|---|---|
| UUID | 3c9ea89b-3aa7-49ce-a7f2-a9a22105c1c0 |
| Fingerprint | 3930f9191c43b50d |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | Jan. 26, 2021, midnight |
| Added to db | Aug. 31, 2024, 12:02 a.m. |
| Last updated | Nov. 17, 2024, 6:49 p.m. |
| Headline | UNKNOWN |
| Title | The source of everything: digital forensic examination of incidents involving source code leaks |
| Detected Hints/Tags/Attributes | 62/1/32 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://blog.group-ib.com/gitlab_jenkins_forensics |
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 36 | ✔ | Blog Group-IB | https://blog.group-ib.com/rss.xml | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 1 | gitlab.test.net |
|
| Details | Domain | 4 | test.net |
|
| Details | Domain | 1 | secure-service-master.zip |
|
| Details | Domain | 1 | jenkins.test.net |
|
| Details | Domain | 3 | jenkins.security |
|
| Details | Domain | 1 | secure-service.zip |
|
| Details | 1 | ferdinand@test.net |
||
| Details | File | 2 | production_json.log |
|
| Details | File | 1 | application_json.log |
|
| Details | File | 1 | api_json.log |
|
| Details | File | 1 | secure-service-master.zip |
|
| Details | File | 1 | jenkins.log |
|
| Details | File | 49 | config.xml |
|
| Details | File | 15 | audit.log |
|
| Details | File | 8 | user.xml |
|
| Details | File | 1 | secure-service.zip |
|
| Details | IPv4 | 25 | 172.17.0.1 |
|
| Details | IPv4 | 1 | 172.17.0.19 |
|
| Details | IPv4 | 1441 | 127.0.0.1 |
|
| Details | Url | 1 | http://gitlab.test.net |
|
| Details | Url | 1 | http://gitlab.test.net/admin/users/ferdinand |
|
| Details | Url | 1 | http://gitlab.test.net/-/profile/personal_access_tokens |
|
| Details | Url | 1 | http://jenkins.test.net:8080 |
|
| Details | Url | 1 | http://jenkins.test.net:8080/login?from= |
|
| Details | Url | 1 | http://jenkins.test.net:8080/loginerror |
|
| Details | Url | 1 | http://jenkins.test.net:8080/manage |
|
| Details | Url | 1 | http://jenkins.test.net:8080/securityrealm |
|
| Details | Url | 1 | http://jenkins.test.net:8080/securityrealm/adduser |
|
| Details | Url | 1 | http://jenkins.test.net:8080/job/secure-service |
|
| Details | Url | 1 | http://gitlab.test.net/root/secure-service |
|
| Details | Url | 1 | http://jenkins.test.net:8080/job/secure-service/12/ws |
|
| Details | Url | 1 | http://jenkins.test.net:8080/job/secure-service/12/execution/node/3/ws |