IntelMQ-dev June 2026

intelmq-dev@lists.cert.at

4 participants
3 discussions

A few more optional fields to the Shadowserver Special feed (SocGholish this time around)?
by Mika Silander 25 Jun '26

25 Jun '26

Hi, The Special feed of Shadowserver was dedicated to reports on SocGholish Compromised WordPress sites a few days ago and https://github.com/The-Shadowserver-Foundation/report_schema/tree/main/inte… was updated accordingly. Today's reports contained a few more optional fields that were caught by our checker, namely, extra.account extra.estimated_server_first_seen_time, extra.estimated_server_last_seen_time extra.machine_name Will intelmq.json be updated to reflect this change? The two extra.estimated_* are probably thought of as replacements to the initial extra.first_seen_time and extra.last_seen_time. Maybe it would make sense to define a feed of its own for this instead of using Special. Especially if we expect to see remnant cases of SocGholish later. And if this is in fact a problem of our checker, my apologies, please let me know. There's so much hallucination going on these days so it would not be a surprise. Br, Mika The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacy<https://csc.fi/en/privacy> T?m?n s?hk?postin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkil?n tai yhteis?n k?ytt??n, jolle ne on osoitettu. Jos et ole viestiss? tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta v?litt?m?sti viestin l?hett?j?lle. Tietoja henkil?tietojen ja yhteystietojen k?sittelyst? l?yd?t CSC:n verkkosivuilta: Tietosuoja<https://csc.fi/tietosuoja>

2 1

Proposed mapping for Targeted Host
by elsif 23 Jun '26

23 Jun '26

Hello, Below is the draft mapping for a new report as documented at https://www.shadowserver.org/what-we-do/network-reporting/targeted-host-rep… Please let me know if you have any comments or suggestions. Regards, Jason { "constant_fields" : { "classification.identifier" : "targeted-host", "classification.taxonomy" : "other", "classification.type" : "system-compromise" }, "feed_name" : "Targeted-Host", "file_name" : "targeted_host", "optional_fields" : [ [ "malware.name", "family", "validate_to_none" ], [ "severity", "severity", "validate_to_none" ], [ "protocol.transport", "protocol" ], [ "source.port", "port", "convert_int" ], [ "source.reverse_dns", "hostname" ], [ "extra.", "tag" ], [ "source.asn", "asn", "invalidate_zero" ], [ "source.geolocation.cc", "geo" ], [ "source.geolocation.region", "region" ], [ "source.geolocation.city", "city" ], [ "extra.source.naics", "naics", "invalidate_zero" ], [ "extra.", "hostname_source", "validate_to_none" ], [ "extra.source.sector", "sector", "validate_to_none" ], [ "product.vendor", "device_vendor", "validate_to_none" ], [ "extra.", "device_type", "validate_to_none" ], [ "product.name", "device_model", "validate_to_none" ], [ "product.version", "device_version", "validate_to_none" ], [ "event_description.text", "category", "validate_to_none" ], [ "status", "status" ], [ "extra.", "detail", "validate_to_none" ], [ "extra.", "public_source", "validate_to_none" ], [ "extra.", "application", "validate_to_none" ] ], "required_fields" : [ [ "time.source", "timestamp", "add_UTC_to_timestamp" ], [ "source.ip", "ip", "validate_ip" ] ], "url" : "https://www.shadowserver.org/what-we-do/network-reporting/targeted-host-rep…" }

1 0

Proposed mapping for Initial Access Broker
by elsif 09 Jun '26

09 Jun '26

Hello, Below is the proposed mapping for a new report as documented at https://www.shadowserver.org/what-we-do/network-reporting/initial-access-br… Please let me know if you have any changes before June 15th. Regards, Jason { "constant_fields" : { "classification.taxonomy" : "malicious-code", "classification.type" : "infected-system" }, "feed_name" : "Initial-Access-Broker", "file_name" : "event4_initial_access_broker", "optional_fields" : [ [ "classification.identifier", "infection", "validate_to_none" ], [ "malware.name", "infection", "validate_to_none" ], [ "extra.", "tag", "validate_to_none" ], [ "extra.", "family", "validate_to_none" ], [ "protocol.transport", "protocol" ], [ "source.asn", "src_asn", "invalidate_zero" ], [ "source.geolocation.cc", "src_geo" ], [ "source.geolocation.region", "src_region" ], [ "source.geolocation.city", "src_city" ], [ "source.reverse_dns", "src_hostname" ], [ "extra.source.naics", "src_naics", "invalidate_zero" ], [ "extra.source.sector", "src_sector", "validate_to_none" ], [ "product.vendor", "device_vendor", "validate_to_none" ], [ "extra.", "device_type", "validate_to_none" ], [ "product.name", "device_model", "validate_to_none" ], [ "severity", "severity", "validate_to_none" ], [ "destination.ip", "dst_ip", "validate_ip" ], [ "destination.port", "dst_port", "convert_int" ], [ "destination.asn", "dst_asn", "invalidate_zero" ], [ "destination.geolocation.cc", "dst_geo" ], [ "destination.geolocation.region", "dst_region" ], [ "destination.geolocation.city", "dst_city" ], [ "destination.reverse_dns", "dst_hostname", "validate_to_none" ], [ "extra.destination.naics", "dst_naics", "invalidate_zero" ], [ "extra.destination.sector", "dst_sector", "validate_to_none" ], [ "extra.", "public_source", "validate_to_none" ], [ "extra.", "application", "validate_to_none" ], [ "extra.", "version", "validate_to_none" ], [ "extra.", "event_id", "validate_to_none" ], [ "source.account", "account", "validate_to_none" ], [ "extra.", "detail", "validate_to_none" ], [ "extra.", "org_domain", "validate_to_none" ], [ "extra.", "machine_name", "validate_to_none" ] ], "required_fields" : [ [ "time.source", "timestamp", "add_UTC_to_timestamp" ], [ "source.ip", "src_ip", "validate_ip" ] ], "url" : "https://www.shadowserver.org/what-we-do/network-reporting/initial-access-br…" }

3 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

IntelMQ-dev June 2026