This is a script module for Bro 2.1+ that encapsulates and detects activity related to the Mandiant APT1 report.