{ "Event": { "uuid": "207c913d-e57f-534b-ac8a-08e8ebf9933d", "info": "Multi-Actor AI-Agent Framework Abuse (8 Operators)", "date": "2026-06-16", "threat_level_id": 1, "analysis": 2, "timestamp": 1791727756, "publish_timestamp": 1791727756, "published": true, "Orgc": { "name": "The Hunters Ledger", "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d" }, "Tag": [ { "name": "tlp:clear", "colour": "#ffffff" }, { "name": "hunters-ledger:topic=\"AI Abuse\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Multi-Family\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Threat\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Open Dir\"", "colour": "#58a6ff" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Security Account Manager - T1003.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Rootkit - T1014\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"RC Scripts - T1037.004\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Clear Command History - T1070.003\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Domain Accounts - T1078.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Domain Fronting - T1090.004\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Password Spraying - T1110.003\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Trusted Relationship - T1199\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Code Repositories - T1213.003\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Compute Hijacking - T1496.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Network Denial of Service - T1498\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Reflection Amplification - T1498.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Data from Cloud Storage - T1530\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell Configuration Modification - T1546.004\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"XDG Autostart Entries - T1547.013\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1568\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Linker Hijacking - T1574.006\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Server - T1583.004\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Email Accounts - T1585.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Develop Capabilities - T1587\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1588.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Tool - T1588.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerability Scanning - T1595.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Escape to Host - T1611\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"System Language Discovery - T1614.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Financial Theft - T1657\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Hide Infrastructure - T1665\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1685\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Clear Linux or Mac System Logs - T1685.006\"", "colour": "#0088cc" } ], "Attribute": [ { "uuid": "4e3dc295-92a4-53f1-b5fd-318732018edb", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "to_ids": false, "comment": "Detection rules, The Hunters Ledger", "timestamp": 1791727756 }, { "uuid": "b2c0caf9-9b04-5eb9-926b-7f69b35e7993", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/ioc-feeds/ai-agent-frameworks-2026-05-23-iocs.json", "to_ids": false, "comment": "IOC feed (JSON), The Hunters Ledger", "timestamp": 1791727756 }, { "uuid": "c3acd92b-6bb4-5cb9-aadb-ae27bc823c82", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/", "to_ids": false, "comment": "Report, The Hunters Ledger", "timestamp": 1791727756 }, { "uuid": "ac1d94f0-8851-5d36-8bb6-66e453aa3f53", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/stix/ai-agent-frameworks-2026-05-23.json", "to_ids": false, "comment": "STIX 2.1 bundle, The Hunters Ledger", "timestamp": 1791727756 }, { "uuid": "cb188c96-0a4a-5c56-8c1c-c42e1deb2d53", "type": "sha256", "category": "Payload delivery", "value": "0c748b9e8bc6b5b4fe989df67655f3301d28ef81617b9cbe8e0f6a19d4f9b657", "to_ids": true, "comment": "sha256: 0c748b9e8bc6b5b4fe989df67655f3301d28ef81617b9cbe8e0f6a19d4f9b657. XMrig miner disguised as dbus-session-monitor (Vova75Rus/miner GitHub repo); VT 39/65 with 5 YARA-rule hits confirming family [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "a5d4d473-1d37-56fd-95bf-829b59586f85", "type": "sha256", "category": "Payload delivery", "value": "23c3719c7f949d6074fd3505928116df52de0e95e18a0a9e8c966b276b08e4ee", "to_ids": true, "comment": "sha256: 23c3719c7f949d6074fd3505928116df52de0e95e18a0a9e8c966b276b08e4ee. lolMiner GPU miner disguised as gnome-shell-ext-updater (Vova75Rus/miner GitHub repo); VT 23/64; sandbox classifies as XMrig [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "15601c02-e635-5010-8795-65d024ef7752", "type": "sha256", "category": "Payload delivery", "value": "2e07f091d401c1f2267537a2f7c2cb5f68a1c1d994abfc87270dcdf38e8f84bb", "to_ids": true, "comment": "sha256: 2e07f091d401c1f2267537a2f7c2cb5f68a1c1d994abfc87270dcdf38e8f84bb. Sliver-derivative obfuscated single-line loader; 13328 bytes [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "ec5a2696-a2fd-5640-bc4c-1e93ca556f2c", "type": "sha256", "category": "Payload delivery", "value": "2fd960f0ce8b9eb86b37d7389599df080bc831b397f3aaaf212b85278039c2ec", "to_ids": true, "comment": "sha256: 2fd960f0ce8b9eb86b37d7389599df080bc831b397f3aaaf212b85278039c2ec. Sliver-derivative Start-Job orchestrator for screencap + keylogger [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "1fe54a18-4bc4-577a-867f-31874689dbc4", "type": "sha256", "category": "Payload delivery", "value": "518e957c198aceb3b99e8863e311f48aa52a552c195a71822bd601810f337068", "to_ids": true, "comment": "sha256: 518e957c198aceb3b99e8863e311f48aa52a552c195a71822bd601810f337068. PyInstaller-stub crypter; class SliverCrypter; Fernet+zlib+b64; drops decrypted PE to %TEMP%\\svchost_upd.exe via CREATE_NO_WINDOW [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "ada8eabf-75c4-5b6f-a99c-f5e7be6673f6", "type": "sha256", "category": "Payload delivery", "value": "5305c7fc5dbae5c7630984ea0a00568594e4fbb84eca68ab6a05aef97c2e9e03", "to_ids": true, "comment": "sha256: 5305c7fc5dbae5c7630984ea0a00568594e4fbb84eca68ab6a05aef97c2e9e03. Sliver-derivative C2 loader; VT 16/62; Microsoft Trojan:Script/Wacatac.B!ml; Kaspersky UDS:Trojan-Downloader.VBS.Agent; Symantec ISB.Downloader!gen412; process hollowing + AMSI/ETW bypass [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "f295ed7c-ca08-56ff-a2e2-e44afc9ac728", "type": "sha256", "category": "Payload delivery", "value": "58ef3f244dab408fac7117606843a3dbcfb0754b2032a5950e977bc1811c0313", "to_ids": true, "comment": "sha256: 58ef3f244dab408fac7117606843a3dbcfb0754b2032a5950e977bc1811c0313. Rovodev/Pandora Mirai bot deployment script [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "f5b1a50f-185d-5eb9-b490-d043c91f1120", "type": "sha256", "category": "Payload delivery", "value": "5de806617a6d7949a547076d4eb304e6f695cfcac3860bf4c1d5838026ac871f", "to_ids": true, "comment": "sha256: 5de806617a6d7949a547076d4eb304e6f695cfcac3860bf4c1d5838026ac871f. Sliver-derivative round-trip CI verifier; operator-side software engineering discipline indicator [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "593f95f2-b6ee-5677-84bf-ca2ecdafab96", "type": "sha256", "category": "Payload delivery", "value": "7033c45472d358e48e333839e680509ee42d9349bc389d747a424ba74315939e", "to_ids": true, "comment": "sha256: 7033c45472d358e48e333839e680509ee42d9349bc389d747a424ba74315939e. Sliver-derivative primary implant encryptor; freshly generated Fernet key per run [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "d586bc30-b597-5617-b69e-ea60e3b39d45", "type": "sha256", "category": "Payload delivery", "value": "7112cd222d1c90fa18fc4f5520800a44891ad5770bdda71772d471377d66b1ee", "to_ids": true, "comment": "sha256: 7112cd222d1c90fa18fc4f5520800a44891ad5770bdda71772d471377d66b1ee. Sliver-derivative keylogger; GetAsyncKeyState polling, batches POST to http://5.230.201.54/api/v/keylog [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "c6e9d883-b413-5947-8216-145483598a7e", "type": "sha256", "category": "Payload delivery", "value": "d3fd9994b16dc9b14c29f7faf7b5f6c84f44b06fccf82f0031a0871ce5e20e17", "to_ids": true, "comment": "sha256: d3fd9994b16dc9b14c29f7faf7b5f6c84f44b06fccf82f0031a0871ce5e20e17. Pandora.sh HTTP:80 dropper - Mirai/Xbash family, VT 12/63; execution_parent for Naku.spc per VT [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "76404ad2-9b40-516e-b60a-890c28c2c7c1", "type": "sha256", "category": "Payload delivery", "value": "d55e488cb7af11ab252cfacbfeb2c9d30289d371d9b54af85466e8814f25ca02", "to_ids": true, "comment": "sha256: d55e488cb7af11ab252cfacbfeb2c9d30289d371d9b54af85466e8814f25ca02. Sliver loader iteration v29; 6671 bytes, 164 lines [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "711ce29f-3db3-5c29-a808-6d8f5adb07b8", "type": "sha256", "category": "Payload delivery", "value": "eaaa10c840de23335abae1a9ead0a6a7fb7be5187cd19ad05137feab12bb7301", "to_ids": true, "comment": "sha256: eaaa10c840de23335abae1a9ead0a6a7fb7be5187cd19ad05137feab12bb7301. GHOST kit LD_PRELOAD libc-hook rootkit (ELF64); byte-identical across operator-A and operator-B deployments; VT 0/0 NEVER SCANNED by any AV; 27 hide-strings + 9 hide-ports; hooks readdir/readdir64/fopen/fopen64 [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "2b694d0a-6e30-5f7d-ae34-b3e4129eab22", "type": "sha256", "category": "Payload delivery", "value": "edafde0d33ff1a169c0c4eeaeec12d1759818c7cf4950fcee91c687e811e6cff", "to_ids": true, "comment": "sha256: edafde0d33ff1a169c0c4eeaeec12d1759818c7cf4950fcee91c687e811e6cff. GHOST kit LD_PRELOAD rootkit C source (98 lines); dense single-character-identifier hand-written style [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "4c2b5e98-3a22-5af9-97af-670d9c357505", "type": "sha256", "category": "Payload delivery", "value": "f3c7cde94261f6664891357b399198a73b9741a7a435527807dca5b3bb86e5f0", "to_ids": true, "comment": "sha256: f3c7cde94261f6664891357b399198a73b9741a7a435527807dca5b3bb86e5f0. Sliver-derivative screencap client; streams to operator backend on TCP/9093 [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "41c302c7-83ad-5b16-9d4d-89d9c29ebfff", "type": "domain", "category": "Network activity", "value": "antipublic.one", "to_ids": true, "comment": "domain: antipublic.one. Russian credential-database paid subscription service - operator is paying customer for breach-data lookups during mass-WP-credential validation [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "b1e612fe-f675-5657-9083-5d2e8ea24d56", "type": "domain", "category": "Network activity", "value": "auto.c3pool.org", "to_ids": true, "comment": "domain: auto.c3pool.org. Operator-B (sibling) public XMR pool destination [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "0faa3a9e-c236-5cbf-9126-2a16b0a0e89f", "type": "domain", "category": "Network activity", "value": "c2.tralalarkefe.com", "to_ids": true, "comment": "domain: c2.tralalarkefe.com. Russian operator C2 command channel (Cloudflare Tunnel-fronted; mandatory Mozilla/5.0 UA) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "53cb40b2-771d-5155-863b-34bd6db0c61b", "type": "domain", "category": "Network activity", "value": "catchall1.tralalarkefe.com", "to_ids": true, "comment": "domain: catchall1.tralalarkefe.com. Russian operator Mailpit catch-all (Phase 8) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "d69dc43b-43b7-5633-a716-eee795a55230", "type": "domain", "category": "Network activity", "value": "cfx-asia1.nanopool.org", "to_ids": true, "comment": "domain: cfx-asia1.nanopool.org. Operator-B (sibling) public Conflux pool destination [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "cdac2228-8155-5e11-9275-6041f4748806", "type": "domain", "category": "Network activity", "value": "cfx.kryptex.network", "to_ids": true, "comment": "domain: cfx.kryptex.network. Operator-A Conflux mining pool destination [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "88d8321a-42f7-5121-92f0-cb63e87b13d7", "type": "domain", "category": "Network activity", "value": "docs.openclaw.ai", "to_ids": true, "comment": "domain: docs.openclaw.ai. OpenClaw documentation (pre-whitelisted for Claude Code WebFetch in Korean operator allowlist) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "5a4c58d9-de40-5199-be14-52c32b4bb7bf", "type": "domain", "category": "Network activity", "value": "duty-free.cc", "to_ids": true, "comment": "domain: duty-free.cc. Russian carding forum where operator is forum-active (saved MHTML thread in operator archive) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "abd6db29-1fb5-51cb-ae08-351201e759ae", "type": "domain", "category": "Network activity", "value": "etc.kryptex.network", "to_ids": true, "comment": "domain: etc.kryptex.network. Operator-A Ethereum Classic mining pool destination [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "03b409b3-3a85-5858-b104-928723165eda", "type": "domain", "category": "Network activity", "value": "gil_dr1.tralalarkefe.com", "to_ids": true, "comment": "domain: gil_dr1.tralalarkefe.com. victim Linux/mgmt host SSH tunnel (Phase 8) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "9db08dd5-0700-5e4e-83c6-d4b4aa5499a0", "type": "domain", "category": "Network activity", "value": "hermes-agent.nousresearch.com", "to_ids": true, "comment": "domain: hermes-agent.nousresearch.com. NousResearch Hermes Agent model catalog | Legitimate NousResearch endpoint; presence alone is not malicious [confidence 60/100]", "timestamp": 1791727756 }, { "uuid": "1674fea6-e447-5e43-b945-91a4fd2668cd", "type": "domain", "category": "Network activity", "value": "lightmake.site", "to_ids": true, "comment": "domain: lightmake.site. OpenClaw developer brand domain [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "eb906623-8fe5-5148-8bb3-f08d33dcbcdb", "type": "domain", "category": "Network activity", "value": "openclaw.ai", "to_ids": true, "comment": "domain: openclaw.ai. OpenClaw distribution domain (curl install + npm i -g) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "0c8b53fb-0449-514b-b175-6fd09ebe9ed3", "type": "domain", "category": "Network activity", "value": "payloads.tralalarkefe.com", "to_ids": true, "comment": "domain: payloads.tralalarkefe.com. Russian operator payload distribution channel [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "9997f1b9-ae96-5a3f-b8d0-99136061afc9", "type": "domain", "category": "Network activity", "value": "skillhub-1388575217.cos.ap-guangzhou.myqcloud.com", "to_ids": true, "comment": "domain: skillhub-1388575217.cos.ap-guangzhou.myqcloud.com. OpenClaw shared skill bucket (Tencent Cloud Object Storage) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "1c011d6d-2267-54b4-8a15-cbb7d7d1b3c5", "type": "domain", "category": "Network activity", "value": "tenant-upcoming-great-descending.trycloudflare.com", "to_ids": true, "comment": "domain: tenant-upcoming-great-descending.trycloudflare.com. One-time C2-bundle bootstrap tunnel (Phase 8) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "6f0608c6-5b1e-5d56-9ef5-ca61578ea76c", "type": "domain", "category": "Network activity", "value": "tralalarkefe.com", "to_ids": true, "comment": "domain: tralalarkefe.com. Operator-bespoke domain root for Cloudflare Tunnel-fronted C2 [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "594675ae-e213-5f89-a710-52e96acf9f0e", "type": "domain", "category": "Network activity", "value": "windows_server.tralalarkefe.com", "to_ids": true, "comment": "domain: windows_server.tralalarkefe.com. victim Windows RDP/WinRM tunnel (Phase 8) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "87d6d337-5d2a-53c8-bb5d-fa0601f72ba6", "type": "url", "category": "Network activity", "value": "http://209.38.205.158:8096/api/ingest/instana", "to_ids": true, "comment": "url: http://209.38.205.158:8096/api/ingest/instana. Turkish ARPA operator C2 ingestion endpoint [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "e307ed0f-294f-5732-b3b6-21e8e20bcdde", "type": "url", "category": "Network activity", "value": "http://5.230.201.54/api/v/keylog", "to_ids": true, "comment": "url: http://5.230.201.54/api/v/keylog. Sliver keylogger HTTP POST endpoint [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "c2a80607-2459-5f50-818c-02461f0b7b9b", "type": "url", "category": "Network activity", "value": "http://5.230.201.54:8080/decryption_key.txt", "to_ids": true, "comment": "url: http://5.230.201.54:8080/decryption_key.txt. Sliver implant Fernet key (44-char base64) [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "fbccfbb8-971e-5c3f-ac77-3370c18572ba", "type": "url", "category": "Network activity", "value": "http://5.230.201.54:8080/encrypted_v2.b64", "to_ids": true, "comment": "url: http://5.230.201.54:8080/encrypted_v2.b64. Sliver implant Fernet+zlib+b64 ciphertext [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "4d48d0ff-40fa-5ad7-a20b-b27be58356bf", "type": "url", "category": "Network activity", "value": "http://77.110.96.200/libpam_cache.c", "to_ids": true, "comment": "url: http://77.110.96.200/libpam_cache.c. GHOST kit LD_PRELOAD rootkit source distribution [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "000c685f-8f35-5482-a6c0-3aca462d562a", "type": "url", "category": "Network activity", "value": "http://77.110.96.200/libpam_cache.so", "to_ids": true, "comment": "url: http://77.110.96.200/libpam_cache.so. GHOST kit LD_PRELOAD rootkit binary distribution [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "817412fc-5e7e-57a2-adfe-86555ad9ff0c", "type": "url", "category": "Network activity", "value": "http://77.110.96.200:3301", "to_ids": true, "comment": "url: http://77.110.96.200:3301. Hysteria v2 operator admin panel [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "9e6f0c52-a0cf-5911-8eed-fcd8bb4c3c70", "type": "url", "category": "Network activity", "value": "https://github.com/Vova75Rus/ComfyUI-Shell-Executor", "to_ids": true, "comment": "url: https://github.com/Vova75Rus/ComfyUI-Shell-Executor. Operator-A's GHOST kit PIP_PAYLOAD_REPO - account SUSPENDED by GitHub T&S 2026-05-25 (returns HTTP 404) [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "f41972b3-3629-57ef-8556-5ccd692dc8f2", "type": "url", "category": "Network activity", "value": "https://github.com/jamestechdev-oss/ComfyUI-Shell-Plugin", "to_ids": true, "comment": "url: https://github.com/jamestechdev-oss/ComfyUI-Shell-Plugin. Operator-B's GHOST kit PIP_PAYLOAD_REPO - DELETED + entire account scrubbed [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "60b5dd1e-44bb-578a-8f89-9052f3a42a04", "type": "url", "category": "Network activity", "value": "https://github.com/keyosbuff/C2-Leak", "to_ids": true, "comment": "url: https://github.com/keyosbuff/C2-Leak. Rovodev operator's upstream C2 source - currently HTTP 404 (deleted/private as of 2026-05-24 verification) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "3ecb5b62-3ffe-582f-b7a9-3e8d812c0bf7", "type": "url", "category": "Network activity", "value": "https://openclaw.ai/install.sh", "to_ids": true, "comment": "url: https://openclaw.ai/install.sh. OpenClaw curl-bash installer (pre-whitelisted in Korean operator's Claude Code allowlist) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "ea91cab0-ef83-5120-92c6-3231051945b4", "type": "ip-dst", "category": "Network activity", "value": "139.59.239.112", "to_ids": true, "comment": "ipv4: 139.59.239.112. Weevely + Claude AI compromised DigitalOcean VPS [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "7d9f4e02-223d-5e62-9b8f-b07f2232ea02", "type": "ip-dst", "category": "Network activity", "value": "158.178.214.94", "to_ids": false, "comment": "ipv4: 158.178.214.94. DEMOTED - Hunt-labeled 'Dual-AI Attacker Infrastructure' but actually French entrepreneur running wikiprepa.fr alumni platform; surfaced only for false-positive disambiguation | Confirmed legitimate developer (elyasbetter@gmail.com owns alumni platform); NOT a threat actor [confidence 40/100]", "timestamp": 1791727756 }, { "uuid": "54721000-e184-5f7c-8422-5872c1e6be70", "type": "ip-dst", "category": "Network activity", "value": "165.227.175.161", "to_ids": true, "comment": "ipv4: 165.227.175.161. Naku.arm CNC - parasitic listener on compromised GetYourGroup tourism VPS (DigitalOcean); port 23 disguises CNC as innocuous Telnet traffic | Underlying VPS host belongs to GetYourGroup GmbH legitimate tourism platform - notify victim before blocking [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "20a3d137-35a7-524a-b8de-b180633a9fbf", "type": "ip-dst", "category": "Network activity", "value": "173.249.2.23", "to_ids": false, "comment": "ipv4: 173.249.2.23. DEMOTED Phase 11 - Hunt-labeled 'Cloud-Credentialed AI Attacker' but actually defensive SaaS-security consultant; Contabo France; surfaced only for false-positive disambiguation | Confirmed false positive per Phase 11 review (979 source files, 226 grep hits all FP); NOT a threat actor - notify Anthropic on exposed credentials only [confidence 40/100]", "timestamp": 1791727756 }, { "uuid": "5040ac99-4271-595f-9fbb-24de9d2b03a1", "type": "ip-dst", "category": "Network activity", "value": "188.166.194.243", "to_ids": true, "comment": "ipv4: 188.166.194.243. Sibling of GetYourGroup CNC (28 GetYourGroup tourism domains hosted); RunCloud SaaS snapshot-deploy artifact [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "469dcdc4-88cd-5c76-a493-74183e18c4bc", "type": "ip-dst", "category": "Network activity", "value": "209.38.205.158", "to_ids": true, "comment": "ipv4: 209.38.205.158. Turkish ARPA / OpenClaw operator C2 ingestion endpoint (state-insurer victim observability harvest); DigitalOcean LLC [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "23c10e1a-34e7-5986-9171-125ca2b327da", "type": "ip-dst", "category": "Network activity", "value": "213.165.51.115", "to_ids": true, "comment": "ipv4: 213.165.51.115. Russian Gemini operator credential mill C2 / open-directory host; AEZA GROUP LLC (Russian bulletproof hosting, US-registered) [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "de842cce-1432-53c6-9bb1-82b3e61be5db", "type": "ip-dst", "category": "Network activity", "value": "221.150.15.104", "to_ids": true, "comment": "ipv4: 221.150.15.104. Korean Claude Code + OpenClaw operator; Korea Telecom; open-directory exposes attacker-customized settings.local.json [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "ff116b6b-1a2b-56d2-a47a-4aff8daa5513", "type": "ip-dst", "category": "Network activity", "value": "34.34.57.141", "to_ids": true, "comment": "ipv4: 34.34.57.141. Russian operator's GCP ghost-proxy-nl Dante SOCKS5 [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "3225020a-1ea3-5b89-b09a-599c3c156d5e", "type": "ip-dst", "category": "Network activity", "value": "34.34.81.129", "to_ids": true, "comment": "ipv4: 34.34.81.129. Russian operator Windows C2 (Phase 4) [confidence 60/100]", "timestamp": 1791727756 }, { "uuid": "39a7d00b-2704-5ffa-bc42-2ae667fbb762", "type": "ip-dst", "category": "Network activity", "value": "35.192.41.201", "to_ids": true, "comment": "ipv4: 35.192.41.201. Russian operator's GCP temp-mail-srv Mailpit catch-all [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "ae8f7287-9286-53e0-acf7-6c81bab4fa6f", "type": "ip-dst", "category": "Network activity", "value": "47.110.83.41", "to_ids": false, "comment": "ipv4: 47.110.83.41. DEMOTED - Hunt-labeled 'Sophisticated Chinese-speaking Threat Actor' but actually Chinese AI/multimedia developer using dmxapi-claude-code for ai-comic-video project; surfaced only for false-positive disambiguation | Confirmed legitimate Chinese AI developer; port 666 is symbolic choice, not malicious; NOT a threat actor [confidence 40/100]", "timestamp": 1791727756 }, { "uuid": "e360f349-482d-5526-a2f0-bcbb4bb4ba26", "type": "ip-dst", "category": "Network activity", "value": "5.230.201.54", "to_ids": true, "comment": "ipv4: 5.230.201.54. Sliver-derivative C2 platform; Netherlands (RIPE NCC), AS200051 'Rizki Abdul Azis'; v30-v39 loader iterations in 1 day; staging/learning phase (empty Sliver DB) [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "635db231-4626-5e5b-9bea-1cb4c3a05e7b", "type": "ip-dst", "category": "Network activity", "value": "66.94.120.32", "to_ids": false, "comment": "ipv4: 66.94.120.32. DEMOTED Phase 11 - Hunt-labeled 'Multi-AI Offensive Workstation' but actually HuggingFace researcher mtr7x doing Sarvam-30B quantization; Contabo US; surfaced only for false-positive disambiguation | Confirmed false positive per Phase 11 review (213 triage reports, 0 real offensive hits); NOT a threat actor - notify HF + Anthropic + OpenAI + Google T&S on exposed credentials only [confidence 40/100]", "timestamp": 1791727756 }, { "uuid": "6e01582e-7333-5cfd-8734-3558580fa94d", "type": "ip-dst", "category": "Network activity", "value": "68.183.92.28", "to_ids": true, "comment": "ipv4: 68.183.92.28. 60-second AI-orchestrated payment API attack origin (6 timestamped stages) [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "e90ea900-88ad-5654-948c-080474ec0a4c", "type": "ip-dst", "category": "Network activity", "value": "77.110.125.145", "to_ids": true, "comment": "ipv4: 77.110.125.145. GHOST kit sibling customer (operator-B); abandoned 40+ days as of investigation; unreachable since 2026-05-24 [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "d1069234-b37c-52db-8cc6-d8bce503f5d0", "type": "ip-dst", "category": "Network activity", "value": "77.110.96.200", "to_ids": true, "comment": "ipv4: 77.110.96.200. AEZA Germany GPU cryptojacking platform (operator-A); GHOST kit customer; self-hosted XMR pool proxy on :3333; CFX pool proxy on :4444; Hysteria v2 panel on :3301; libpam_cache.so + ghost.sh + hyst.sh + min1.sh deployed [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "5e7da25d-0349-5158-8941-2fa86bcee133", "type": "ip-dst", "category": "Network activity", "value": "80.211.111.10", "to_ids": true, "comment": "ipv4: 80.211.111.10. Aruba S.p.A. Italy sibling distribution server embedded in all 11 Naku binaries; dark to Hunt 365-day index [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "1f45256e-4ca3-5d85-b767-400a48d79994", "type": "ip-dst", "category": "Network activity", "value": "80.211.94.16", "to_ids": true, "comment": "ipv4: 80.211.94.16. Aruba S.p.A. Italy distribution server embedded in all 11 Naku binaries; dark to Hunt 365-day index (burning-fuse indicator) [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "208eff25-4a9e-5650-a959-ffd3eddea1aa", "type": "ip-dst", "category": "Network activity", "value": "85.17.70.56", "to_ids": true, "comment": "ipv4: 85.17.70.56. Russian operator's ai_sniper_brute.py Dutch datacenter proxy [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "08f0a4cf-5f8d-5b6a-9341-693071b6a972", "type": "ip-dst", "category": "Network activity", "value": "87.106.143.220", "to_ids": true, "comment": "ipv4: 87.106.143.220. Rovodev/Pandora Mirai botnet C2 (Matrix C2 + standalone Mirai-clone); 1&1 IONOS Germany [confidence 95/100]", "timestamp": 1791727756 }, { "uuid": "8ca888ce-a9f7-50f8-a420-d2459691525a", "type": "ip-dst", "category": "Network activity", "value": "87.106.54.213", "to_ids": true, "comment": "ipv4: 87.106.54.213. Rovodev/Pandora backup VPS [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "0c87f682-92f1-56d7-9905-56cd7c07f316", "type": "ip-dst", "category": "Network activity", "value": "95.211.175.167", "to_ids": true, "comment": "ipv4: 95.211.175.167. Russian operator's ai_sniper_brute.py Dutch datacenter proxy [confidence 80/100]", "timestamp": 1791727756 }, { "uuid": "40dd194a-7bca-5aee-93ae-8ee1cc6157b6", "type": "snort", "category": "Network activity", "value": "alert dns $HOME_NET any -> any any (msg:\"THL HUNT AI-Agent-Campaign Kryptex Mining Pool DNS Query (Any kryptex.network Subdomain, Includes cfx. and etc. Pool Hosts)\"; dns_query; content:\".kryptex.network\"; nocase; isdataat:!1,relative; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/; classtype:trojan-activity; sid:9200001; rev:3; metadata:author The_Hunters_Ledger, date 2026-05-25;)", "to_ids": false, "comment": "Kryptex Mining Pool DNS Query (Any kryptex.network Subdomain) | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1496.001 | rule hash bbc4d760 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "837f8792-6cf4-5cf6-a7ed-964fe4f2348f", "type": "snort", "category": "Network activity", "value": "alert dns $HOME_NET any -> any any (msg:\"THL HUNT AI-Agent-Campaign c3pool.org Mining Pool DNS Query (Cryptojacker Activity)\"; dns_query; content:\"c3pool.org\"; nocase; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/; classtype:trojan-activity; sid:9200002; rev:2; metadata:author The_Hunters_Ledger, date 2026-05-25;)\nalert dns $HOME_NET any -> any any (msg:\"THL HUNT AI-Agent-Campaign nanopool.org Mining Pool DNS Query (Cryptojacker Activity)\"; dns_query; content:\"nanopool.org\"; nocase; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/; classtype:trojan-activity; sid:9200003; rev:2; metadata:author The_Hunters_Ledger, date 2026-05-25;)\nalert dns $HOME_NET any -> any any (msg:\"THL HUNT AI-Agent-Campaign moneroocean.stream Mining Pool DNS Query (Cryptojacker Activity)\"; dns_query; content:\"moneroocean.stream\"; nocase; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/; classtype:trojan-activity; sid:9200004; rev:2; metadata:author The_Hunters_Ledger, date 2026-05-25;)\nalert dns $HOME_NET any -> any any (msg:\"THL HUNT AI-Agent-Campaign hashvault.pro Mining Pool DNS Query (Cryptojacker Activity)\"; dns_query; content:\"hashvault.pro\"; nocase; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/; classtype:trojan-activity; sid:9200005; rev:2; metadata:author The_Hunters_Ledger, date 2026-05-25;)", "to_ids": false, "comment": "Generic Cryptojacker Mining Pool DNS Pattern (c3pool / nanopool / moneroocean / hashvault) | TIER: Hunting | robustness 2 | confidence MODERATE — generic cryptomining indicator not tied to a specific kit family; both the GHOST kit and unrelated cryptojackers use these public pools as fallback destinations | ATT&CK T1496.001 | rule hash da41f891 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "cb2714be-71da-5c3e-b209-b2b08a64f589", "type": "snort", "category": "Network activity", "value": "alert dns $HOME_NET any -> any any (msg:\"THL HUNT AI-Agent-Campaign trycloudflare.com Quick-Tunnel DNS Query (C2 Transport Indicator)\"; dns_query; content:\"trycloudflare.com\"; nocase; isdataat:!1,relative; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/; classtype:trojan-activity; sid:9200000; rev:3; metadata:author The_Hunters_Ledger, date 2026-05-25;)", "to_ids": false, "comment": "trycloudflare.com DNS Query Egress | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1583.006, T1090.004 | rule hash 3d995969 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "e7536d21-4695-5bbb-a860-a179ef3f4e0c", "type": "snort", "category": "Network activity", "value": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL DETECT AI-Agent-Campaign Russian A2A C2 X-Agent-Id Header + API Endpoint (Case 1 C2 Protocol Indicator)\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; content:\"/api/v1/\"; startswith; http.header_names; content:\"X-Agent-Id\"; nocase; reference:url,the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/; classtype:trojan-activity; threshold:type limit,track by_src,count 3,seconds 3600; sid:9200007; rev:3; metadata:author The_Hunters_Ledger, date 2026-05-25;)", "to_ids": true, "comment": "A2A C2 X-Agent-Id Header + API Endpoint Pattern | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1071.001, T1132.001 | rule hash 6bb81745 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "b9acb3a6-ad1b-5b55-8207-85da3e5128a3", "type": "snort", "category": "Network activity", "value": "alert quic $HOME_NET any -> any [14433,14444] (msg:\"THL HUNT AI-Agent-Campaign QUIC SNI Containing bing.com on GHOST Kit Operator Ports 14433 and 14444 (Hysteria v2 Masquerade Lead)\"; flow:to_server; quic.sni; content:\"bing.com\"; nocase; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/; classtype:trojan-activity; sid:9200006; rev:4; metadata:author The_Hunters_Ledger, date 2026-05-25, modified 2026-08-20;)", "to_ids": false, "comment": "QUIC SNI Containing bing.com on UDP 14433/14444 (Hysteria v2 Masquerade Lead, Case 9) | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1090.004, T1665 | rule hash 6b2d7864 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "d33acd91-72d4-56b5-86e6-11fa78c9e3d2", "type": "sigma", "category": "Payload installation", "value": "title: >-\n Instana API Enumeration Script via -SkipCertificateCheck to an Ocpinstana\n Endpoint (ARPA Observability Harvester)\nid: f9c5ebeb-d6b8-4425-bb85-bfa4d30e28ac\nstatus: experimental\ndescription: >-\n Detects PowerShell execution of Instana API enumeration scripts using the -SkipCertificateCheck\n flag alongside references to the ocpinstana endpoint pattern, characteristic of the\n Turkish ARPA operator's instana_local_collector.ps1 script. The script makes sliding\n 10-minute-window GET /api/events requests with a stolen 10-year Instana JWT to\n exfiltrate observability telemetry to the attacker's ARPA platform. Detection from\n PowerShell Script Block Logging is highly reliable when -SkipCertificateCheck appears\n alongside Instana endpoint strings. The rule matches those two strings in the script block\n text; it does not inspect the JWT or the source host.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\nmodified: '2026-10-10'\ntags:\n - attack.collection\n - attack.exfiltration\n - attack.t1119\n - detection.emerging-threats\n - stp.3\nlogsource:\n product: windows\n category: ps_script\n definition: Script Block Logging must be enabled (reg key HKLM\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging=1)\ndetection:\n selection:\n ScriptBlockText|contains|all:\n - SkipCertificateCheck\n - ocpinstana\n condition: selection\nfalsepositives:\n - >-\n Legitimate Instana API clients that use -SkipCertificateCheck for internal OCP\n self-signed certificates. Narrow by source host — the attacker's exfiltration\n target is not a legitimate Instana destination.\nlevel: high", "to_ids": true, "comment": "Instana API Enumeration Script via -SkipCertificateCheck to an ocpinstana Endpoint (ARPA Observability Harvester, Case 2) | TIER: Detection | robustness 2 | confidence HIGH (PowerShell Script Block Logging detection); MODERATE (network-side proxy detection) | ATT&CK T1119, T1530 | rule hash 2b51c8f3 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "80e83fa4-93cc-5e38-a884-387b42899131", "type": "sigma", "category": "Payload installation", "value": "title: >-\n Claude Code settings.local.json or settings.json Modified\nid: 803d43fe-6b5a-48e1-b25f-9da5e74bca62\nstatus: experimental\ndescription: >-\n Detects modification of a Claude Code permissions file (settings.local.json /\n settings.json). File-event telemetry cannot inspect the file content, so this is\n a hunting lead: after it fires, review whether the change added an auto-approved\n dangerous command (for example a curl-to-shell pattern) to the permissions\n allow-list.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\nmodified: '2026-09-30'\ntags:\n - attack.stealth\n - attack.persistence\n - attack.defense-impairment\n - attack.t1685\n - detection.emerging-threats\nlogsource:\n category: file_event\n product: linux\ndetection:\n selection:\n TargetFilename|endswith:\n - /.claude/settings.local.json\n - /.claude/settings.json\n filter_vendor:\n TargetFilename|contains: /node_modules/\n condition: selection and not filter_vendor\nfalsepositives:\n - >-\n Routine or legitimate edits to Claude Code settings (common) — review the\n added permission entries. Investigate file content after alert — the\n curl-pipe-bash and npm-i-g-unfamiliar patterns are the high-confidence indicators\n within a triggered file modification.\n - >-\n Third-party npm packages occasionally ship a fixture file at a path fragment\n matching this rule (observed: es-abstract, selfsigned) inside their own\n node_modules tree. These have no effect on Claude Code's real configuration and\n are excluded.\nlevel: medium", "to_ids": false, "comment": "Claude Code settings.local.json or settings.json Modified | TIER: Hunting | robustness 2 | confidence MODERATE — the rule's own description states this is a hunting lead, not an alert | ATT&CK T1685 | rule hash 91fb71c3 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "b484c899-e97b-5483-933e-1277c18dde0b", "type": "sigma", "category": "Payload installation", "value": "title: AI Coding-Agent Binary Execution on a Linux Host\nid: 67cd7a66-7487-4bc2-94b5-2db9ffbf2080\nname: ai_agent_tooling_exec_serverhost\nstatus: experimental\ndescription: >-\n Base rule (not alerting on its own): execution of an AI coding-agent binary\n from its state directory (Claude Code, Gemini CLI, RovoDev, OpenClaw) on a\n Linux host; the rule does not test whether the host is a server. Paired with the correlation rule below, which flags co-location\n with offensive tooling.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\nmodified: '2026-10-10'\ntags:\n - attack.resource-development\n - attack.t1587\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_ai_tools:\n Image|contains:\n - /.claude/\n - /gemini\n - /rovodev\n - /openclaw\n condition: selection_ai_tools\nfalsepositives:\n - Legitimate developer or operator use of AI coding agents on the host\nlevel: informational\n---\ntitle: Offensive Tooling Execution on a Linux Host\nid: 2fa74c68-e65d-46b3-b516-cc12400ddaee\nname: offensive_tooling_exec_serverhost\nstatus: experimental\ndescription: >-\n Base rule (not alerting on its own): execution of offensive/network tooling\n (nuclei, frpc/frps, masscan, nmap). Paired with the correlation rule below.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\nmodified: '2026-10-10'\ntags:\n - attack.resource-development\n - attack.t1588.002\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_offensive_tools:\n Image|endswith:\n - /nuclei\n - /frpc\n - /frps\n - /masscan\n - /nmap\n condition: selection_offensive_tools\nfalsepositives:\n - Authorized security testing or network administration on the host\nlevel: low\n---\ntitle: AI Coding-Agent Tooling Co-Located with Offensive Tooling on the Same Host\nid: 337c7b1d-0f56-4c27-932f-2ea507ba24f1\nstatus: experimental\ndescription: >-\n Fires when both AI coding-agent execution and offensive-tooling execution\n are observed on the same host within 24 hours. This co-location — not either\n signal alone — is the indicator of AI-orchestrated attack infrastructure.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\nmodified: '2026-10-10'\ntags:\n - attack.resource-development\n - attack.t1587\n - attack.t1588.002\n - detection.emerging-threats\ncorrelation:\n type: temporal\n rules:\n - ai_agent_tooling_exec_serverhost\n - offensive_tooling_exec_serverhost\n group-by:\n - host.name\n timespan: 24h\nfalsepositives:\n - A host legitimately used both for AI-assisted development and authorized security testing\nlevel: high", "to_ids": true, "comment": "AI Coding-Agent Tooling Co-Located with Offensive Tooling on the Same Host | TIER: Detection | robustness 2 | confidence MODERATE — co-presence of AI tools and offensive tooling on a server host warrants investigation but is not conclusive by itself | ATT&CK T1587, T1588.002 | rule hash 547ea714 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "a9cd1a08-9600-55a9-8824-ee58aa597a4c", "type": "sigma", "category": "Payload installation", "value": "title: Cloudflared Access TCP Tunnel Registration\nid: 0d88f829-c8e3-42e5-a3c3-34cb8a5fec1a\nstatus: experimental\ndescription: >-\n Detects execution of 'cloudflared access tcp' with the --hostname flag, indicating\n an operator is activating a Cloudflare tunnel to proxy TCP traffic (RDP, SSH, WinRM)\n through Cloudflare infrastructure. Observed in Case 1 (Russian Gemini operator)\n maintaining persistent RDP access via windows_server.tralalarkefe.com and SSH access\n via gil_dr1.tralalarkefe.com. Legitimate usage requires a formally managed Cloudflare\n Zero Trust account configuration — ad-hoc usage with operator-bespoke domains\n indicates tunneled lateral movement or a C2 channel.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\nmodified: '2026-10-10'\ntags:\n - attack.command-and-control\n - attack.lateral-movement\n - attack.t1090.004\n - detection.emerging-threats\n - stp.3\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith:\n - /cloudflared\n - /cloudflared.exe\n CommandLine|contains|all:\n - access\n - tcp\n - --hostname\n condition: selection\nfalsepositives:\n - >-\n Legitimate Cloudflare Zero Trust TCP application proxies configured by network\n administrators. Allowlist known Cloudflare Access deployment hostnames — attacker-\n controlled hostnames will not match corporate Zero Trust domains.\nlevel: high", "to_ids": true, "comment": "Cloudflared Access TCP Tunnel Registration | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1090.004, T1021.001, T1021.004 | rule hash 819baa8c | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "dfd2a341-f69d-5640-80cc-1789a31470ac", "type": "sigma", "category": "Payload installation", "value": "title: Cryptojacker LD_PRELOAD Rootkit Drop to /lib/security (PAM-Style Camouflage Naming)\nid: 6c7e9d33-7dc3-411b-994f-37d431e05907\nstatus: experimental\ndescription: >-\n Detects a Linux file event whose path contains one of the PAM module directories\n (/lib/security/, /usr/lib/security/ or their x86_64-linux-gnu variants) and the string\n libpam_cache, the GHOST cryptojacker kit's deceptive PAM-style name. The rule tests\n two path substrings only: no .so extension, no test that libpam_cache starts the file\n name, and any file event on the path (create or write) counts.\n Once loaded, the rootkit hides its own filename from readdir output, making\n filesystem-level detection via ls unreliable. This rule targets the write event\n before the rootkit activates.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\ntags:\n - attack.persistence\n - attack.stealth\n - attack.execution\n - attack.t1574.006\n - attack.t1036.005\n - detection.emerging-threats\n - stp.3\nlogsource:\n product: linux\n category: file_event\n definition: 'Requires Linux file events that carry the full path in TargetFilename, for example Sysmon for Linux file creation or an EDR file-event feed. Raw auditd watch records need normalising to a full-path field first.'\ndetection:\n selection_path:\n TargetFilename|contains:\n - /lib/security/\n - /lib/x86_64-linux-gnu/security/\n - /usr/lib/security/\n - /usr/lib/x86_64-linux-gnu/security/\n selection_name:\n TargetFilename|contains: libpam_cache\n condition: selection_path and selection_name\nfalsepositives:\n - >-\n Legitimate distro packages installing PAM modules — verify parent process is\n apt/dpkg/rpm/yum and not a shell or unknown binary. No legitimate Linux distribution\n ships a libpam_cache.so PAM module.\nlevel: high", "to_ids": true, "comment": "Cryptojacker libpam_cache Drop to /lib/security | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1574.006, T1036.005 | rule hash 322b1b46 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "cffb8d7b-2974-5ab0-87d2-c6cae8f630b4", "type": "sigma", "category": "Payload installation", "value": "title: Egress to AEZA/Contabo/DigitalOcean-SG/IONOS/Korea-Telecom Address Ranges from a Linux Host (Hunting)\nid: bb917d1e-bb95-48d2-bb19-505cd6655456\nstatus: experimental\ndescription: >-\n Hunting rule flagging outbound connections from any Linux host to IP ranges\n associated with the campaign's operator-hosting ASNs (the selection has no source-host\n or host-role filter, so limiting it to production servers is a deployment scoping\n decision, not a test in the rule): AEZA International Group (Case 1\n + Case 9), Contabo GmbH (Cases 5/6 demoted but infra tracked), DigitalOcean Frankfurt/\n Singapore (Case 2 Turkish ARPA), 1&1 IONOS (Case 3 Pandora botnet), Korea Telecom\n (Case 4 Korean operator). High FP rate as a standalone rule — combine with destination\n port specificity to raise confidence.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\ntags:\n - attack.resource-development\n - attack.t1583.003\n - detection.emerging-threats\nlogsource:\n category: network_connection\n product: linux\ndetection:\n selection_high_risk_asn:\n DestinationIp|cidr:\n - 213.165.0.0/16\n - 77.110.0.0/16\n - 209.38.0.0/16\n - 87.106.0.0/16\n - 221.150.0.0/16\n condition: selection_high_risk_asn\nfalsepositives:\n - >-\n CDN egress, legitimate cloud API traffic, third-party service integrations. Use as\n a hunting pivot combined with destination port filters (mining ports, C2 elite ports).\nlevel: low", "to_ids": false, "comment": "Egress to Operator-Hosting ASN Ranges from a Linux Host (Baseline Pivot) | TIER: Hunting | robustness 1 | confidence LOW — ASN-based egress rules have inherently high FP rates in cloud-connected environments | ATT&CK T1583.003 | rule hash 26db6fd4 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "fd8493d7-66f0-570c-9731-8e19aff59783", "type": "sigma", "category": "Payload installation", "value": "title: GHOST Kit ComfyUI Fake Custom Node PerformanceMonitor Registration (Case 9)\nid: 3f6f8f15-2716-4cc1-8eb6-12b9c3bf2c60\nstatus: experimental\ndescription: >-\n Detects registration of the GHOST cryptojacker kit's fake ComfyUI custom node\n \"PerformanceMonitor\" (display name \"GPU Performance Monitor\") used to establish\n persistence on ComfyUI-hosting AI inference servers. The fake node is installed via\n pip from the kit-author's GitHub repos. Detection is by file creation only: a file under\n ComfyUI's custom_nodes directory matching the PerformanceMonitor or kit-author node\n names, or a created file whose path contains a kit-author repo name. The rule does not\n inspect process creation, so a pip command line is not matched.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\nmodified: '2026-10-10'\ntags:\n - attack.persistence\n - attack.impact\n - attack.t1496.001\n - detection.emerging-threats\n - stp.3\nlogsource:\n category: file_event\n product: linux\ndetection:\n selection_node:\n TargetFilename|contains:\n - /ComfyUI/custom_nodes/PerformanceMonitor\n - /ComfyUI/custom_nodes/ComfyUI-Shell-Executor\n - /ComfyUI/custom_nodes/ComfyUI-Shell-Plugin\n selection_pip:\n TargetFilename|contains:\n - Vova75Rus/ComfyUI-Shell-Executor\n - jamestechdev-oss/ComfyUI-Shell-Plugin\n condition: selection_node or selection_pip\nfalsepositives:\n - >-\n No known legitimate ComfyUI custom node uses the PerformanceMonitor node name.\n The kit-author GitHub repos were suspended by GitHub T&S, so new pip install\n attempts from those URLs will now fail — but locally cached copies may persist.\nlevel: high", "to_ids": true, "comment": "GHOST Kit ComfyUI Fake Custom Node PerformanceMonitor Registration (Case 9) | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1543.002, T1496.001 | rule hash b5f64fad | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "cc887eb2-ecaa-508b-a23f-709de7f8c0f0", "type": "sigma", "category": "Payload installation", "value": "title: Linux DNS Query to the Gemini API or AI Studio Domain (Hunting Lead)\nid: 06d6f95f-2946-4bb9-b0ff-49921d91922f\nstatus: experimental\ndescription: >-\n Detects DNS queries from Linux hosts for generativelanguage.googleapis.com or\n aistudio.google.com. The rule has no host-role field and no view of what a query is\n for, so it fires on every Linux host that resolves either name and cannot show that a\n key was validated. Case 1 (Russian Gemini operator) uses stolen Gemini API keys\n validated via check_keys.py, and the same endpoint is used by the LLM-personalized\n credential mutation script to invoke Gemini 2.5 Flash for per-target password\n generation at attack time. A deployment that knows which hosts have an expected AI\n workload scopes those out locally.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\ntags:\n - detection.emerging-threats\nlogsource:\n category: dns_query\n product: linux\ndetection:\n selection:\n query|contains:\n - generativelanguage.googleapis.com\n - aistudio.google.com\n condition: selection\nfalsepositives:\n - >-\n Legitimate AI applications and developer tools that use the Gemini API. Requires\n host-role classification to be effective — suppress on designated AI application\n servers and developer workstations.\nlevel: low", "to_ids": false, "comment": "Linux DNS Query to the Gemini API or AI Studio Domain (Hunting Lead) | TIER: Hunting | robustness 1 | confidence MODERATE | rule hash 2b9d0489 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "bb0cbd4c-e7b6-5a10-83de-985d340fcc79", "type": "sigma", "category": "Payload installation", "value": "title: Linux File Event Under a .rovodev Directory (Atlassian Rovodev Agent Presence Lead)\nid: c88a8604-f07b-452b-821e-ecd610edd062\nstatus: experimental\ndescription: >-\n Detects any Linux file event whose path contains /.rovodev/, the directory where the\n Atlassian Rovodev AI coding agent keeps its state. The rule tests the path substring\n only: no directory-creation event, no home-directory anchor and no host role. While\n Rovodev is a legitimate enterprise product, its presence on server infrastructure co-located with offensive\n tooling indicates an AI-integrated threat operator. Case 3 (Rovodev/Pandora operator)\n had ~/.rovodev/sessions/ containing 1.24 MB AI-authoring session JSONs.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\ntags:\n - detection.emerging-threats\nlogsource:\n category: file_event\n product: linux\ndetection:\n selection:\n TargetFilename|contains: /.rovodev/\n condition: selection\nfalsepositives:\n - >-\n Legitimate Atlassian Rovodev users on developer workstations and Atlassian-licensed\n development servers. Apply host-role classification.\nlevel: medium", "to_ids": false, "comment": "Linux File Event Under a .rovodev Directory (Atlassian Rovodev Agent Presence Lead) | TIER: Hunting | robustness 1 | confidence MODERATE — the `.rovodev/` directory alone could appear on any host where a developer legitimately uses Rovodev | rule hash 65e9ecc2 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "430c8d3a-d38a-5c2a-95cd-155f615a06d6", "type": "sigma", "category": "Payload installation", "value": "title: Linux LD_PRELOAD Rootkit Persistence via /etc/ld.so.preload Modification\nid: 8961351c-34c4-4a6e-b031-16a6368ae15e\nstatus: experimental\ndescription: >-\n Detects writes or creates of /etc/ld.so.preload, which is the persistence mechanism\n for userland LD_PRELOAD rootkits including the GHOST v5.1/v6.0 cryptojacker kit's\n libpam_cache.so rootkit. Legitimate /etc/ld.so.preload usage is rare on production\n servers. When present post-alert, inspect the file content for non-standard library\n paths and cross-reference /lib/security/ for newly written .so files.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\n - https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\ntags:\n - attack.persistence\n - attack.stealth\n - attack.execution\n - attack.t1574.006\n - detection.emerging-threats\nlogsource:\n product: linux\n category: file_event\ndetection:\n selection:\n TargetFilename: /etc/ld.so.preload\n condition: selection\nfalsepositives:\n - >-\n Performance/instrumentation libraries that legitimately use LD_PRELOAD (libfaketime,\n libsegfault, libtcmalloc, valgrind, vtune) — typically confined to dev/test environments.\n Correlate with parent process: apt/dpkg writes are expected; shell/unknown-binary writes\n are high-confidence malicious.\nlevel: high", "to_ids": true, "comment": "/etc/ld.so.preload Modification (LD_PRELOAD Rootkit Persistence) | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1574.006, T1014 | rule hash 44698e14 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "cb2309ed-8c20-5f56-820f-0499bd2cb204", "type": "sigma", "category": "Payload installation", "value": "title: Trycloudflare.com Quick-Tunnel DNS Query\nid: 5581299d-e9a1-4a83-b85c-8d68a93fd03b\nstatus: experimental\ndescription: >-\n Detects DNS queries for trycloudflare.com ephemeral tunnels from any Linux host (the rule has no host-role or developer-host test, and does not inspect process creation).\n Threat actors (Case 1 Russian Gemini operator) use Cloudflare quick-tunnels to proxy\n C2 traffic through Cloudflare infrastructure, disguising the true C2 IP and bypassing\n egress firewall rules. Trycloudflare subdomains are ephemeral and randomly generated\n (e.g. tenant-upcoming-great-descending.trycloudflare.com) — not predictable by defenders.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\nmodified: '2026-10-10'\ntags:\n - attack.command-and-control\n - attack.t1090.004\n - detection.emerging-threats\nlogsource:\n category: dns_query\n product: linux\ndetection:\n selection:\n query|endswith: .trycloudflare.com\n condition: selection\nfalsepositives:\n - >-\n Developers and CI/CD pipelines using Cloudflare Tunnel for local development exposure\n (ngrok-alternative use case). Exempt known developer/CI hosts by hostname or subnet.\nlevel: medium", "to_ids": false, "comment": "Trycloudflare.com Quick-Tunnel DNS Query | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1090.004 | rule hash 8586ee42 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "23f012f3-0c90-52bc-9a43-4407f7763ce2", "type": "sigma", "category": "Payload installation", "value": "title: Web Request to API, Auth, Payment or Transaction URI Path (Machine-Speed Sequence Building Block)\nid: f8fbdc2e-b653-4b9c-b56d-2c004c202ea5\nstatus: experimental\ndescription: >-\n Flags individual web requests whose URI stem contains /api/, /auth/, /payment/ or\n /transaction/, the kind of endpoints touched in the stages of a machine-speed,\n multi-stage API attack tied to LLM-orchestrated attack tooling. Case 8 documented a\n 6-stage payment API exploitation completed in under 60 seconds. The rule tests no\n count, window or sequence: operationalizing the 60-second/4+-endpoint velocity\n signature requires a SIEM correlation search across API access logs, not expressible\n as a single Sigma detection rule. Hunting leads only.\nreferences:\n - https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/\nauthor: The Hunters Ledger\ndate: '2026-05-25'\ntags:\n - attack.impact\n - attack.t1657\n - detection.emerging-threats\nlogsource:\n category: webserver\n product: linux\ndetection:\n selection:\n cs-uri-stem|contains:\n - /api/\n - /auth/\n - /payment/\n - /transaction/\n condition: selection\nfalsepositives:\n - >-\n Legitimate payment processing automation, API health check systems, and load\n balancer probe sequences. A 30-day API call velocity baseline per source IP is\n recommended before operationalizing.\nlevel: low", "to_ids": false, "comment": "Web Request to API, Auth, Payment or Transaction URI Path (Machine-Speed Sequence Building Block) | TIER: Hunting | robustness 1 | confidence LOW — the 60-second window and API sequence correlate with the observed case but the underlying LLM vendor is unidentified | ATT&CK T1657 | rule hash 831d5377 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "974d91c8-dc2e-5adf-b38f-aff1874ce561", "type": "yara", "category": "Payload installation", "value": "/*\n Yara Rule Set\n Identifier: AI-Agent-Framework-Abuse-MultiActor-2026-05-23\n Author: The Hunters Ledger\n Source: https://the-hunters-ledger.com/\n License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule TOOLKIT_AI_Operator_Handoff_Document {\n meta:\n description = \"Detects operator-authored Markdown handoff documents written for AI agent consumption — a novel artifact class where threat actors document their C2 infrastructure and session context for AI tool re-priming. Observed in Case 1 (Russian Gemini operator with explicit 'To: Gemini CLI' headers) and Case 3 (Rovodev operator with 22+ session-prime docs).\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/\"\n date = \"2026-05-25\"\n modified = \"2026-10-10\"\n family = \"AI-Operator-Handoff-Document\"\n malware_type = \"Operator-TTP-Artifact\"\n campaign = \"AI-Agent-Framework-Abuse-MultiActor-2026-05-23\"\n id = \"de0c2440-341f-5828-a60f-805ce499d95e\"\n strings:\n $h1 = \"To: Gemini CLI\" ascii nocase\n $h2 = \"From: Gemini CLI\" ascii nocase\n $h3 = \"To: Claude Code\" ascii nocase\n $h4 = \"To: Claude\" ascii nocase\n $h5 = \"From: Claude\" ascii nocase\n $h6 = \"To: Rovodev\" ascii nocase\n $h1b = \"**To:** Gemini CLI\" ascii nocase\n $h2b = \"**From:** Gemini CLI\" ascii nocase\n $d1 = \"refer to this file when starting a new session\" ascii nocase\n $d2 = \"when starting a new session\" ascii nocase\n $d3 = \"read this file first\" ascii nocase\n $d4 = \"before beginning any task\" ascii nocase\n $d5 = \"AI agent handoff\" ascii nocase\n $i1 = \"C2_MIGRATION_GUIDE\" ascii\n $i2 = \"C2_INFRA_TRANSFER\" ascii\n $i3 = \"DEPLOYED_TOOLS\" ascii\n $i4 = \"tralalarkefe.com\" ascii nocase\n condition:\n filesize < 500KB and\n (\n (1 of ($h*) and 1 of ($d*)) or\n (2 of ($h1, $h2, $h3, $h5, $h6, $h1b, $h2b)) or\n (1 of ($i1, $i2, $i3) and 1 of ($d*)) or\n ($i4 and (1 of ($h*) or 1 of ($d*) or 1 of ($i1, $i2, $i3)))\n )\n}", "to_ids": false, "comment": "AI Operator Handoff Document | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1587, T1059.006 | rule hash 35f1656e | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "dee69f75-ab5a-530a-84e6-1b91564b287b", "type": "yara", "category": "Payload installation", "value": "import \"elf\"\n\nrule MAL_Linux_GHOST_LDPreload_Rootkit_Family {\n meta:\n description = \"Detects the libpam_cache.so LD_PRELOAD userland rootkit shipped with the GHOST v5.1/v6.0 cryptojacker kit. Matches an ELF64 file under 100 KB that defines readdir and fopen as dynamic-symbol functions and holds the kit's miner-hiding strings, miner path strings and /proc net-hook strings, plus LD_PRELOAD and libpam_cache. The report describes the sample as also hooking readdir64 and fopen64 and calling unsetenv('LD_PRELOAD') in a constructor; the rule tests neither. Observed byte-identical across at least 2 customer deployments.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/\"\n date = \"2026-05-25\"\n modified = \"2026-10-11\"\n hash1 = \"eaaa10c840de23335abae1a9ead0a6a7fb7be5187cd19ad05137feab12bb7301\"\n hash3 = \"296a800564111b0bad9fe63faf4e63ba\"\n family = \"GHOST-Cryptojacker-LDPreload-Rootkit\"\n malware_type = \"Rootkit\"\n campaign = \"AI-Agent-Framework-Abuse-MultiActor-2026-05-23\"\n id = \"33629b27-5b2f-5982-b950-b610a07ab9e6\"\n strings:\n $s1 = \"xmrig\" ascii fullword\n $s2 = \"lolMiner\" ascii fullword\n $s3 = \"khugepaged_\" ascii\n $s4 = \"inotify_guard\" ascii fullword\n $p1 = \"fontconfig/.cpu\" ascii\n $p2 = \"fontconfig/.gpu\" ascii\n $p3 = \".pid_guard\" ascii\n $h1 = \"/proc/net/tcp\" ascii\n $h2 = \"/proc/%s/cmdline\" ascii\n $h3 = \":%04X\" ascii\n $c1 = \"LD_PRELOAD\" ascii fullword\n $f1 = \"libpam_cache\" ascii\n condition:\n uint32(0) == 0x464c457f and\n uint8(4) == 2 and\n filesize < 100KB and\n elf.dynsym_entries > 12 and\n for any sym in elf.dynsym : (sym.name == \"readdir\" and sym.type == elf.STT_FUNC and sym.shndx > 0) and\n for any sym in elf.dynsym : (sym.name == \"fopen\" and sym.type == elf.STT_FUNC and sym.shndx > 0) and\n 3 of ($s*) and\n 2 of ($p*) and\n all of ($h*) and\n $c1 and\n $f1\n}", "to_ids": true, "comment": "libpam_cache LD_PRELOAD Rootkit Family Signature | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1574.006, T1014, T1564.001, T1027 | rule hash 29e5da22 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "4ca9302a-b7f4-5427-8165-a16222116556", "type": "yara", "category": "Payload installation", "value": "rule MAL_Linux_ARPA_Observability_Harvester_Systemd {\n meta:\n description = \"Detects the Turkish ARPA operator's observability-harvester platform based on distinctive systemd service unit filenames and operator self-branding strings. ARPA ingests stolen observability telemetry (IBM Instana + SolarWinds + Zabbix + VMware Aria via stolen API tokens) into a TimescaleDB+Neo4j+Redis stack.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/\"\n date = \"2026-05-25\"\n family = \"ARPA-Observability-Harvester\"\n malware_type = \"Data-Harvesting-Platform\"\n campaign = \"AI-Agent-Framework-Abuse-MultiActor-2026-05-23\"\n id = \"08b8e947-a673-53c1-9303-6843c8e8ec50\"\n strings:\n $svc1 = \"arpa-instana-api.service\" ascii\n $svc2 = \"arpa-autolearn.service\" ascii\n $svc3 = \"arpa-continuous.service\" ascii\n $svc4 = \"arpa-daemon.service\" ascii\n $svc5 = \"arpa-parallel.service\" ascii\n $b1 = \"ARPA Korelasyon Motoru\" ascii\n $b2 = \"ARPA \\xc2\\xa9 2026\" ascii\n $e1 = \"/api/ingest/instana\" ascii\n condition:\n filesize < 5MB and\n (\n (2 of ($svc*)) or\n $b1 or\n (1 of ($svc*) and ($e1 or $b2))\n )\n}", "to_ids": true, "comment": "ARPA Observability Harvester Systemd Service Pattern | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1543.002, T1119, T1041 | rule hash de7a4008 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "dec0e4f9-7e91-57ef-b631-db016eee93c2", "type": "yara", "category": "Payload installation", "value": "rule MAL_Linux_GHOST_Kit_Installer_Shell {\n meta:\n description = \"Detects the GHOST v5.1/v6.0 cryptojacker kit installer (ghost.sh) based on distinctive operator-coined function names. The _anti_hisana function targets rival cryptojacker Hisana for displacement. _compile_hide_so compiles the LD_PRELOAD rootkit (libpam_cache.c) on victim hosts. _container_escape provides 4-variant container breakout capability for Docker/k8s/LXC cloud GPU environments.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/\"\n date = \"2026-05-25\"\n hash1 = \"58ef3f244dab408fac7117606843a3dbcfb0754b2032a5950e977bc1811c0313\"\n family = \"GHOST-Cryptojacker-Kit\"\n malware_type = \"Cryptojacker-Installer\"\n campaign = \"AI-Agent-Framework-Abuse-MultiActor-2026-05-23\"\n id = \"bcd488b4-ec22-5a44-824b-404064b3fcb0\"\n strings:\n $fn1 = \"_anti_hisana\" ascii fullword\n $fn2 = \"_compile_hide_so\" ascii fullword\n $fn3 = \"_container_escape\" ascii fullword\n $fn4 = \"_escape_via_cgroup\" ascii fullword\n $fn5 = \"_escape_via_nsenter\" ascii fullword\n $v1 = \"GHOST v5.1\" ascii\n $v2 = \"GHOST v6.0\" ascii\n $v3 = \"Anti-Hisana\" ascii\n $t1 = \"8415540095\" ascii\n $ld1 = \"ld.so.preload\" ascii\n condition:\n filesize < 2MB and\n (\n (2 of ($fn*)) or\n (1 of ($v*) and 1 of ($fn*)) or\n ($t1 and $ld1 and 1 of ($fn*))\n )\n}", "to_ids": true, "comment": "GHOST Kit Installer Function Signatures (ghost.sh) | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1574.006, T1014, T1611, T1053.003, T1543.002 | rule hash 7adec48b | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "c10f8a77-38a7-5788-b7fd-401c6e65e957", "type": "yara", "category": "Payload installation", "value": "rule MAL_Linux_Pandora_Mirai_Naku_Suite {\n meta:\n description = \"Detects the Rovodev operator's Pandora/Naku Mirai-variant botnet suite based on operator-bespoke naming patterns and the custom 22-character random-string charset. The suite covers 11 IoT architectures served from dual HTTP/HTTPS channels at /bins/Naku.{arch} and /Pandoras_Box/pandora.{arch}. Botnet ID 'PandoraNet' is suffixed by architecture in bot registration beacons.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/\"\n date = \"2026-05-25\"\n family = \"Pandora-Mirai-Variant\"\n malware_type = \"DDoS-Botnet\"\n campaign = \"AI-Agent-Framework-Abuse-MultiActor-2026-05-23\"\n id = \"f3e8e30f-eedc-5e31-ab5e-381ec27010a3\"\n strings:\n $b1 = \"PandoraNet\" ascii fullword\n $b2 = \"PandoraNet.arm\" ascii\n $b3 = \"PandoraNet.x86\" ascii\n $c1 = \"1gba4cdom53nhp12ei0kfj\" ascii\n $d1 = \"/Pandoras_Box/\" ascii\n $d2 = \"/bins/Naku.\" ascii\n $m1 = \"udp-star\" ascii\n $m2 = \"syn-storm\" ascii\n $m3 = \"tcp-matrix\" ascii\n $m4 = \"dns-rain\" ascii\n $m5 = \"ovh-nuke\" ascii\n $r1 = \"INFECTED|\" ascii\n condition:\n (\n (uint32(0) == 0x464c457f and filesize < 2MB and (1 of ($b*) or $c1)) or\n (filesize < 500KB and ($d1 or $d2) and 1 of ($m*)) or\n ($r1 and 2 of ($m*))\n )\n}", "to_ids": true, "comment": "Pandora/Mirai Naku Architecture Naming Pattern | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1498, T1498.002, T1059.004 | rule hash 265c2fd4 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "8bf51070-c61b-52f6-92c1-79e793b23961", "type": "yara", "category": "Payload installation", "value": "rule MAL_Python_Russian_A2A_C2_BaseHTTPServer {\n meta:\n description = \"Detects the Russian Gemini operator's custom A2A (Agent-to-Agent) C2 backend built on Python stdlib BaseHTTPServer: the string BaseHTTPRequestHandler together with the banner A2A C2 MULTI-AGENT CONSOLE, or three of the five /api/v1/ endpoint paths with the X-Agent-ID header, or the decode strings decode('utf-16le') and base64.b64decode with two endpoint paths, or a C2 domain with one endpoint path. The report describes the sample as unauthenticated on all 5 endpoints, with a path-traversal-vulnerable file server and Cloudflare Tunnel transport; the rule tests none of that.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/\"\n date = \"2026-05-25\"\n modified = \"2026-10-11\"\n family = \"Russian-A2A-C2\"\n malware_type = \"Custom-C2-Backend\"\n campaign = \"AI-Agent-Framework-Abuse-MultiActor-2026-05-23\"\n id = \"943da3bd-c273-5e48-829e-1ec1389fd48a\"\n strings:\n $py1 = \"BaseHTTPRequestHandler\" ascii\n $b1 = \"A2A C2 MULTI-AGENT CONSOLE\" ascii\n $e1 = \"/api/v1/update\" ascii\n $e2 = \"/api/v1/agents\" ascii\n $e3 = \"/api/v1/interact\" ascii\n $e4 = \"/api/v1/telemetry\" ascii\n $e5 = \"/api/v1/get_results\" ascii\n $h1 = \"X-Agent-ID\" ascii\n $enc1 = \"decode('utf-16le')\" ascii\n $enc2 = \"base64.b64decode\" ascii\n $d2 = \"c2.tralalarkefe.com\" ascii\n $d3 = \"payloads.tralalarkefe.com\" ascii\n condition:\n filesize < 1MB and\n $py1 and\n (\n $b1 or\n (3 of ($e*) and $h1) or\n ($enc1 and $enc2 and 2 of ($e*)) or\n (($d2 or $d3) and 1 of ($e*))\n )\n}", "to_ids": true, "comment": "Russian A2A C2 Python-stdlib BaseHTTPServer | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1059.006, T1071.001, T1132.001 | rule hash 91d26e9c | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "2ba45149-2dc6-5160-9d0e-5760edbaa157", "type": "yara", "category": "Payload installation", "value": "rule SUSP_AI_Generated_Offensive_Code_Python {\n meta:\n description = \"Detects Python offensive tools bearing the structural signature of AI-generated code: verbose docstrings co-occurring with a bare `except:` handler or a defensive `except Exception as e:` handler (either one satisfies the rule), educational variable names, a rate-limiting marker (time.sleep or rate_limit), and offensive-tool terms. The rule does not test for the absence of anti-analysis. Confirmed cross-operator across 3 independent actors (Case 1 Russian, Case 2 Turkish ARPA, Case 3 Rovodev).\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/\"\n date = \"2026-05-25\"\n modified = \"2026-10-10\"\n family = \"AI-Generated-Offensive-Code\"\n malware_type = \"Offensive-Tool-Structural-Pattern\"\n campaign = \"AI-Agent-Framework-Abuse-MultiActor-2026-05-23\"\n id = \"2ac2da6f-2d42-5e9e-a1b2-f03f13990126\"\n strings:\n $doc1 = \"\\\"\\\"\\\"\" ascii\n $doc2 = \"Args:\" ascii\n $doc3 = \"Returns:\" ascii\n $doc4 = \"Raises:\" ascii\n $exc1 = \"except:\" ascii\n $exc2 = \"except Exception as e:\" ascii\n $var1 = \"target_url\" ascii\n $var2 = \"success_count\" ascii\n $var3 = \"failed_count\" ascii\n $var4 = \"max_workers\" ascii\n $var5 = \"ThreadPoolExecutor\" ascii\n $rate1 = \"time.sleep\" ascii\n $rate2 = \"rate_limit\" ascii\n $off1 = \"wp-login.php\" ascii\n $off2 = \"BaseHTTPRequestHandler\" ascii\n $off3 = \"/api/v1/\" ascii\n $off4 = \"payload\" ascii\n $off5 = \"c2_server\" ascii\n $off6 = \"reverse_shell\" ascii\n $off7 = \"exploit\" ascii\n condition:\n filesize < 2MB and\n $doc1 and\n 1 of ($doc2, $doc3, $doc4) and\n ($exc1 or $exc2) and\n 2 of ($var*) and\n 1 of ($rate*) and\n 2 of ($off*)\n}", "to_ids": false, "comment": "AI-Generated Offensive Code Structural Signature | TIER: Hunting | robustness 2 | confidence MODERATE (each criterion alone is low-confidence; the combination is higher) | ATT&CK T1587, T1059.006 | rule hash af3b2764 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "2248425f-a088-5601-8e6c-01822425663b", "type": "yara", "category": "Payload installation", "value": "rule TOOLKIT_LLM_Personalized_Credential_Mutator {\n meta:\n description = \"Detects Python scripts implementing LLM-personalized credential mutation at attack time — threat actors invoking frontier LLM APIs (Gemini, GPT-4) with per-target email+domain+password context to generate 20 targeted mutations. Observed in Case 1 (russian-ai_sniper_brute.py using Gemini 2.5 Flash).\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/\"\n date = \"2026-05-25\"\n modified = \"2026-10-10\"\n family = \"LLM-Credential-Mutator\"\n malware_type = \"Credential-Theft-Tool\"\n campaign = \"AI-Agent-Framework-Abuse-MultiActor-2026-05-23\"\n id = \"7f000ddc-b613-5b84-a961-4eebc73ea7d4\"\n strings:\n $p1 = \"Act as an expert red-team password analyst\" ascii\n $p2 = \"Output ONLY the 20 passwords\" ascii\n $p3 = \"Most Recent Password from dump\" ascii\n $p4 = \"generate exactly 20 likely current mutations\" ascii\n $p5 = \"Target User:\" ascii\n $p6 = \"Target Domain:\" ascii\n $f1 = \"AI_SNIPER_GOODS.txt\" ascii\n $f2 = \"AI_ADMIN_MUTANTS.txt\" ascii\n $f3 = \"ULTRA_GOLD_TARGETS.txt\" ascii\n $a1 = \"google.generativeai\" ascii\n $a2 = \"gemini-2.5-flash\" ascii\n $a3 = \"generativelanguage.googleapis.com\" ascii\n $w1 = \"wp-login.php\" ascii\n $w2 = \"wordpress_logged_in\" ascii\n condition:\n filesize < 1MB and\n (\n (2 of ($p1, $p2, $p3, $p4)) or\n (1 of ($p1, $p2, $p3, $p4) and $p5 and $p6) or\n (1 of ($f*) and 1 of ($a*)) or\n (1 of ($p1, $p2, $p3, $p4) and 1 of ($a*) and 1 of ($w*))\n )\n}", "to_ids": true, "comment": "LLM-Personalized Credential Mutation Script | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1110.003, T1059.006, T1552.001 | rule hash ee3c6fb9 | https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/", "timestamp": 1791727756, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] } ], "Object": [] } }