# Alerts to Answers · Lab 07 · IOC Enrichment Dataset · v20
# © 2026 Jim Furstenberg - Ph.D., P.I. · Kalos Cybersecurity LLC
#
# SAFETY: Enrich these indicators through reputable intelligence services.
# Do not browse to an indicator, scan it, connect to it, or download content.
# Historical association is evidence to investigate - not automatic authority to block.
#
# Expected workflow:
# 1. Identify the indicator type.
# 2. Enrich it using at least two appropriate sources when possible.
# 3. Record the observation date, result, confidence, and source.
# 4. Distinguish malicious association from current ownership or current activity.
# 5. Add only instructor-approved, high-confidence IP indicators to the lab CDB list.

# --- HISTORICAL THREAT-ASSOCIATED IPv4 INDICATORS ---------------------------
# Source: CISA/FBI/NSA et al., AA24-249A, Appendix B.
# These addresses were historically linked to Unit 29155 infrastructure.
# CISA directs defenders to investigate associated activity; do not treat the
# address alone as proof that present-day traffic or ownership is malicious.
5.226.139.66
45.141.87.11

# --- BENIGN IPv4 CONTEXT TRAPS ----------------------------------------------
# These well-known public resolver addresses test whether the analyst verifies
# ownership and context instead of equating any listed address with an IOC.
1.1.1.1
8.8.8.8

# --- DOMAIN CONTEXT TRAPS ----------------------------------------------------
# Look up reputation and ownership only. Do not visit the domains for this lab.
example.com
eicar.org

# --- SHA-256 DETECTION ANCHOR ------------------------------------------------
# Standard EICAR anti-malware test-file SHA-256. EICAR is not malware, although
# security products intentionally identify it as a detection-validation file.
275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f

# Primary references:
# https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf
# https://www.eicar.org/download-anti-malware-testfile/