{
  "Event": {
    "uuid": "9efa73fb-800e-59f7-96f1-5a1b3e9216ef",
    "info": "Turkish ARPA AI-Augmented Observability Compromise (209.38.205.158)",
    "date": "2026-05-25",
    "threat_level_id": 1,
    "analysis": 2,
    "timestamp": 1792180054,
    "publish_timestamp": 1792180054,
    "published": true,
    "Orgc": {
      "name": "The Hunters Ledger",
      "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d"
    },
    "Tag": [
      {
        "name": "tlp:clear",
        "colour": "#ffffff"
      },
      {
        "name": "hunters-ledger:topic=\"AI Abuse\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Exfil\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Cred Theft\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Open Dir\"",
        "colour": "#58a6ff"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH Authorized Keys - T1098.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Develop Capabilities - T1587\"",
        "colour": "#0088cc"
      }
    ],
    "Attribute": [
      {
        "uuid": "2e543471-52a5-5598-8f44-b2ea42d9bf33",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "to_ids": false,
        "comment": "Detection rules, The Hunters Ledger",
        "timestamp": 1792180054
      },
      {
        "uuid": "9d928a07-4ccf-5624-871b-c2842b183696",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/ioc-feeds/turkish-arpa-openclaw-state-insurer-209.38.205.158-iocs.json",
        "to_ids": false,
        "comment": "IOC feed (JSON), The Hunters Ledger",
        "timestamp": 1792180054
      },
      {
        "uuid": "3c211b8d-a9f9-5b55-9f4e-f95aa20dac65",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/reports/turkish-arpa-openclaw-state-insurer-209.38.205.158/",
        "to_ids": false,
        "comment": "Report, The Hunters Ledger",
        "timestamp": 1792180054
      },
      {
        "uuid": "6abb2dc0-66ec-573b-8203-5934a35c6565",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/stix/turkish-arpa-openclaw-state-insurer-209.38.205.158.json",
        "to_ids": false,
        "comment": "STIX 2.1 bundle, The Hunters Ledger",
        "timestamp": 1792180054
      },
      {
        "uuid": "97b5cc24-34f5-539e-b64f-2fad91ee85ce",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "2736b72ed047fb4d593d2e919c58b25db1a669faa51e630360c2825409bf4011",
        "to_ids": true,
        "comment": "sha256: 2736b72ed047fb4d593d2e919c58b25db1a669faa51e630360c2825409bf4011. Operator-authored Python topology DB analysis script; flagged IndentationError-prone (AI Copy-Paste Indentation Decay sub-signature) [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "46cda99f-a431-573b-bd4d-7781b2de1eff",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "29d1221c9e305374a78d17c01ea20a211d59427f789ed01e653341db51bf4c06",
        "to_ids": true,
        "comment": "sha256: 29d1221c9e305374a78d17c01ea20a211d59427f789ed01e653341db51bf4c06. Operator-authored Python API patch script (Hunt classifier flagged MALICIOUS; Turkish comments) [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "dc1ac517-1d95-5721-9d17-4784bf7e97a3",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "2dca67a8be5cd89863ab60a2351a553954afd641c8e6f6219785707276f0e8e3",
        "to_ids": true,
        "comment": "sha256: 2dca67a8be5cd89863ab60a2351a553954afd641c8e6f6219785707276f0e8e3. Operator-authored Python underlying correlations API implementation [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "2c384468-efb5-523a-9efe-80785cf79a50",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "402422a918dc037e00aea323e2ab1ca3e758459d4cd5e620a4433e3c346c52f8",
        "to_ids": true,
        "comment": "sha256: 402422a918dc037e00aea323e2ab1ca3e758459d4cd5e620a4433e3c346c52f8. Operator-authored Python DB schema patch; only file in cluster with try/except defensive pattern [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "ec02d030-b360-5c62-a17c-57881d71a938",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "5a58c88c64e3e54c874645fc5b32f12163e1901fe1b3fb7a3bc1d52c434b1c62",
        "to_ids": true,
        "comment": "sha256: 5a58c88c64e3e54c874645fc5b32f12163e1901fe1b3fb7a3bc1d52c434b1c62. Operator-authored Python API patch script (re.replace variant) [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "7f8d542a-6dfc-50ac-acaa-b5fda90803e0",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "65d2eb26067c3df4b139b02145bdba2065be5a403f38ad096f886230b41fda9b",
        "to_ids": true,
        "comment": "sha256: 65d2eb26067c3df4b139b02145bdba2065be5a403f38ad096f886230b41fda9b. Operator-authored Python cross-source correlation engine v3; opens with operator self-branding docstring ARPA Korelasyon Motoru v3 - Temporal Focus [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "3e1f0bc2-f65c-5ff0-9c29-13aeb05007af",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "6d4eb14e08e742ce6adabc355855c5e80c6b84e6969b0a3cc58367e0f4babfd0",
        "to_ids": true,
        "comment": "sha256: 6d4eb14e08e742ce6adabc355855c5e80c6b84e6969b0a3cc58367e0f4babfd0. Operator-authored Python API patch script (variant 1); emits emoji-in-output bleed [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "c7d9d762-1d44-5cc3-baa2-f8d2191d8286",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "9928277dbbfbdf95a5f4e98ef99e55b7d87093982dbdd298be16b232bfc39c77",
        "to_ids": true,
        "comment": "sha256: 9928277dbbfbdf95a5f4e98ef99e55b7d87093982dbdd298be16b232bfc39c77. Operator-authored Python event collector v4 (iteration marker); same the victim organization JWT [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "7b3fa92b-b88b-5266-8d86-636316176a71",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "a05b40ceb17e6277ca39f99433910c359764be0e0a42377686abb7fb1e7da410",
        "to_ids": true,
        "comment": "sha256: a05b40ceb17e6277ca39f99433910c359764be0e0a42377686abb7fb1e7da410. Operator-authored Python correlation DB query script; Turkish output SON 5 KORELASYON [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "26d1b146-9dc8-51c9-aceb-cf99cba9a306",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "a4b39f13d17ae3ff7a0adb2cf1df459a72425513f392a1d8fc469f8f2e123de5",
        "to_ids": true,
        "comment": "sha256: a4b39f13d17ae3ff7a0adb2cf1df459a72425513f392a1d8fc469f8f2e123de5. Operator-authored Python Flask API routes for correlations/events; Turkish comments throughout [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "862b3bb6-c562-5085-a274-38fadb28bfc7",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "c66a2561fdacb5997c4fa0501da8ef1639d429d22668bfba7cb2f5f9e97a2a6e",
        "to_ids": true,
        "comment": "sha256: c66a2561fdacb5997c4fa0501da8ef1639d429d22668bfba7cb2f5f9e97a2a6e. Operator-authored Python API patch script (minimal variant) [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "46863cae-9eb5-51cb-ab88-45bfcafce028",
        "type": "sha256",
        "category": "Payload delivery",
        "value": "ee5428e9b47fd102d27d3dcc804b10512100acd21399969efe39e201e61cbf79",
        "to_ids": true,
        "comment": "sha256: ee5428e9b47fd102d27d3dcc804b10512100acd21399969efe39e201e61cbf79. Operator-authored Python Instana topology collector; hardcoded the victim organization JWT + production URL; Turkish docstring [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "ad04c55a-bbaf-5997-98fa-a71538353ec1",
        "type": "domain",
        "category": "Network activity",
        "value": "docs.openclaw.ai",
        "to_ids": true,
        "comment": "domain: docs.openclaw.ai. OpenClaw documentation domain [confidence 80/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "82d6026d-5fd3-5bf5-9eff-e7a65d792386",
        "type": "domain",
        "category": "Network activity",
        "value": "lightmake.site",
        "to_ids": true,
        "comment": "domain: lightmake.site. OpenClaw developer brand domain (vendor identifier) [confidence 80/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "1e317b76-4667-55ab-9a62-04e5135d6546",
        "type": "domain",
        "category": "Network activity",
        "value": "openclaw.ai",
        "to_ids": true,
        "comment": "domain: openclaw.ai. OpenClaw distribution domain, operator framework provider; ecosystem watch for related operators using same framework | OpenClaw is also used legitimately by developers, so this domain carries a MEDIUM false-positive risk. [confidence 80/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "45c7fd26-cc26-5b7d-b723-8c8bc4d9e634",
        "type": "domain",
        "category": "Network activity",
        "value": "skillhub-1388575217.cos.ap-guangzhou.myqcloud.com",
        "to_ids": true,
        "comment": "domain: skillhub-1388575217.cos.ap-guangzhou.myqcloud.com. Tencent COS bucket, OpenClaw shared skill marketplace; egress from non-developer environments is OpenClaw-presence signal | MEDIUM, legitimate Tencent Cloud Object Storage bucket; also used by OpenClaw developers [confidence 80/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "4bd430e2-aae3-5008-8f4a-1ae8f7aeb79d",
        "type": "url",
        "category": "Network activity",
        "value": "http://209.38.205.158:8090/",
        "to_ids": true,
        "comment": "url: http://209.38.205.158:8090/. Operator ARPA v2.1.0 dashboard; publicly reachable; serves /data/ directory listing with 780 entries of exfiltrated the victim organization data + /logs/ directory listing [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "02786bb8-3287-5417-bed8-01b30af4019c",
        "type": "url",
        "category": "Network activity",
        "value": "http://209.38.205.158:8095/api/topology/unified",
        "to_ids": true,
        "comment": "url: http://209.38.205.158:8095/api/topology/unified. Operator unified topology endpoint; degraded to 404 on all paths as of 2026-05-24 but port still TCP-accepting [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "12a60854-5cfe-5171-a7cd-c588e1ac3382",
        "type": "url",
        "category": "Network activity",
        "value": "http://209.38.205.158:8096/api/ingest/instana",
        "to_ids": true,
        "comment": "url: http://209.38.205.158:8096/api/ingest/instana. Operator ARPA C2 ingestion endpoint; HTTP cleartext; accepts Instana event payloads in operator normalized schema; no authentication [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "33721fcd-3546-52a9-8296-0aac8591daf6",
        "type": "url",
        "category": "Network activity",
        "value": "https://github.com/MehmetARPA/ARPA",
        "to_ids": true,
        "comment": "url: https://github.com/MehmetARPA/ARPA. Operator public GitHub repository; same project codename as embedded in operator code; identity artifact. Account suspended by GitHub T&S 2026-05-25, URL now returns HTTP 404; preserve as evidence IOC [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "7a710d75-ce0e-5c64-85e4-c69ee77b5d18",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "209.38.205.158",
        "to_ids": true,
        "comment": "ipv4: 209.38.205.158. Operator C2 host (DigitalOcean); ARPA platform; ports 8090 dashboard, 8095 degraded topology, 8096 ingestion endpoint, 8098 closed since 2026-03-14 [confidence 95/100]",
        "timestamp": 1792180054
      },
      {
        "uuid": "4bd4c85b-a628-5736-bca7-1d524c7c6481",
        "type": "snort",
        "category": "Network activity",
        "value": "alert dns $HOME_NET any -> any any (msg:\"THL HUNT Turkish-ARPA-State-Insurer DNS Query to Victim Instana OCP Tenant (Potential Unauthorized Collector Activity)\"; dns.query; content:\"ocpinstana.[victim-domain].com.tr\"; nocase; threshold:type limit,track by_src,count 1,seconds 300; reference:url,the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/; classtype:policy-violation; sid:9300601; rev:3; metadata:author The_Hunters_Ledger, date 2026-05-26;)",
        "to_ids": false,
        "comment": "DNS Query Egress to the Victim Organization Instana Tenant | TIER: Hunting | robustness 1 | confidence MODERATE | rule hash 135486f9 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "7e016f2d-1424-51ab-a326-62f1da2876b4",
        "type": "snort",
        "category": "Network activity",
        "value": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL DETECT Turkish-ARPA-State-Insurer HTTP POST to ARPA Instana Ingestion Endpoint (Observability Data Exfiltration)\"; http.method; content:\"POST\"; http.uri; content:\"/api/ingest/instana\"; startswith; flow:to_server,established; reference:url,the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/; classtype:trojan-activity; sid:9001005; rev:3; metadata:author The_Hunters_Ledger, date 2026-05-26;)",
        "to_ids": true,
        "comment": "HTTP POST to ARPA Instana Ingestion Endpoint (IP-Agnostic) | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1020, T1041, T1071.001 | rule hash cd816ae5 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "bb782306-3acf-5135-81ed-0d0074070280",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: File Named rca_key.pem Or rca_key.ppk Created In A User SSH Directory\nid: f9b8ab33-5436-4f3a-a996-f737e54a3d37\nstatus: experimental\ndescription: >-\n  Detects creation of a file named rca_key.pem (OpenSSH) or rca_key.ppk (PuTTY) in any\n  Windows user's .ssh directory, the names of the key files the Turkish ARPA operator\n  distributed to the victim-side insider (the victim organization Windows AD user [employee\n  ID — suppressed]) as part of the tunnel-deployment toolkit documented in the operator's\n  Turkish-language insider-recruitment handoff documents. The rule tests the file name and\n  directory only, so a hit is a lead for that toolkit, not proof of it, and a rename of the\n  key file evades it.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - detection.emerging-threats\n    - stp.2\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|contains: '\\.ssh\\'\n        TargetFilename|endswith:\n            - '\\rca_key.pem'\n            - '\\rca_key.ppk'\n    condition: selection\nfalsepositives:\n    - Legitimate administrators who happen to name their SSH keys rca_key (verify key fingerprint and origin against CA records)\nlevel: medium",
        "to_ids": false,
        "comment": "Sigma Rule 9: SSH Key File Named rca_key.pem Or rca_key.ppk In A User `.ssh` Directory | TIER: Hunting | robustness 1 | confidence MODERATE | rule hash 0baf3c0c | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "52f8e01d-3599-544d-b535-404457e3fb0f",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Instana Audit Log Event With The Stolen JWT Or External-Source Access To The Victim Tenant\nid: d4398d0e-e7ea-4b8d-a838-8b2a760fc468\nstatus: experimental\ndescription: >-\n  Detects use of the specific stolen the victim organization Instana JWT (jti withheld) in API\n  calls, or any audit-log event for the victim tenant whose source_ip is not within the\n  RFC1918 ranges, which includes an event with no source_ip value. The second branch matches\n  whatever the event is, including authorized external orchestration. The rule reads no token-lifetime or expiry field and does not identify\n  long-lived tokens in general. The stolen token's lifetime of roughly ten years is a victim-side\n  token management defect that let the Turkish ARPA operator keep persistent access over a\n  multi-year window with a single stolen credential; this is not an IBM Instana CVE. Sigma rule\n  targets Instana audit log telemetry exported to SIEM.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - attack.credential-access\n    - attack.stealth\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.t1078\n    - attack.t1552.001\n    - detection.emerging-threats\n    - stp.3\nlogsource:\n    product: ibm_instana\n    service: audit_log\ndetection:\n    selection_stolen_jti:\n        jwt_jti: '[stolen-token-jti]'\n    selection_stolen_tenant:\n        tenant: '[victim-tenant]'\n    filter_internal_source:\n        source_ip|cidr:\n            - '10.0.0.0/8'\n            - '172.16.0.0/12'\n            - '192.168.0.0/16'\n    condition: selection_stolen_jti or (selection_stolen_tenant and not filter_internal_source)\nfalsepositives:\n    - Authorized Instana admin tools accessing the tenant from external IPs (verify against operations team allow-list)\n    - Token rotation scripts running from external orchestration infrastructure\nlevel: medium",
        "to_ids": false,
        "comment": "Sigma Rule 6: Instana Audit Log Event With The Stolen JWT Or External-Source Access To The Victim Tenant | TIER: Hunting | robustness 2 | confidence HIGH (for the specific stolen JWT); MODERATE (for the external-source tenant-access branch) | ATT&CK T1078, T1552.001 | rule hash 524b0711 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "86e84f95-f642-5ec9-b166-c313f75f21a6",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Instana Topology, Event Or Application API Request\nid: 43f7b91b-3870-4bd1-93c2-d364c8504a2e\nstatus: experimental\ndescription: >-\n  Detects requests whose path starts with /api/events, /api/topology or /api/applications on\n  IBM Instana (a longer path or sub-path sharing a prefix also matches), the endpoints targeted by the\n  Turkish ARPA operator's multi-worker polling pattern. A single request is not by itself\n  anomalous. The operator's ARPA platform polls the Instana events API once per five-minute\n  cycle from the operator VPS, so this campaign's own polling is a periodic low-rate pattern\n  and not a measured burst. This rule surfaces the underlying event for rate-based correlation\n  in the SIEM layer; a per-source-IP request-rate threshold (for example 10 or more per\n  minute) is a proposed, unvalidated companion for enumeration in general, since Sigma's\n  non-correlation rule format cannot itself express a count-over-time aggregation.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - attack.collection\n    - attack.t1119\n    - attack.t1213\n    - attack.discovery\n    - attack.t1046\n    - detection.emerging-threats\nlogsource:\n    product: ibm_instana\n    service: api_access_log\ndetection:\n    selection:\n        RequestPath|startswith:\n            - '/api/events'\n            - '/api/topology'\n            - '/api/applications'\n    condition: selection\nfalsepositives:\n    - Authorized Instana integrations with high query frequency (verify against operations team allow-list)\n    - Load testing or API validation tooling during maintenance windows\n    - Any single legitimate topology or event API query — this rule requires rate-based correlation (10+ requests/min from one source IP) to distinguish enumeration activity from normal API use\nlevel: medium",
        "to_ids": false,
        "comment": "Sigma Rule 8: Instana Topology, Event Or Application API Request (Building Block For Rate Correlation) | TIER: Hunting | robustness 1 | confidence MODERATE — a single request is not by itself anomalous. | ATT&CK T1046, T1213, T1119 | rule hash e5150b07 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "31170c5c-d921-558a-ae1c-401a6148b687",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Non-Splunk Process Connecting to Localhost Port 8089 on Enterprise Host\nid: 47e5169f-572c-4d87-9fda-578a23e58beb\nstatus: experimental\ndescription: >-\n  Detects network-connection events whose destination is loopback (127.0.0.1 or ::1) port\n  8089, from any process other than Splunk (which legitimately uses port 8089 for management)\n  and Razer App Engine (excluded after a measured collision). The selection tests the\n  destination address, destination port and the initiating image only: it has no protocol,\n  direction or listening-state test, so a UDP event or an accepted connection with those\n  values also qualifies, and nothing in it shows a listener or an SSH tunnel. Port 8089\n  is the insider-side tunnel bind point in the Turkish ARPA operator's reverse SSH tunnel\n  architecture: traffic from localhost:8089 on the insider's machine is forwarded through\n  the SSH reverse tunnel to the operator's listener on port 18080 at 209.38.205.158.\n  A non-Splunk process reaching that loopback port is a lead for that tunnel, but the port is\n  not unique to this campaign and requires triage.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - attack.command-and-control\n    - attack.t1572\n    - attack.lateral-movement\n    - attack.t1021.004\n    - detection.emerging-threats\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        DestinationIp:\n            - '127.0.0.1'\n            - '::1'\n        DestinationPort: 8089\n    filter_splunk:\n        Image|endswith:\n            - '\\Splunk\\bin\\splunkd.exe'\n            - '\\Splunk\\bin\\splunk.exe'\n            - '\\SplunkUniversalForwarder\\bin\\splunkd.exe'\n            - '\\SplunkUniversalForwarder\\bin\\splunk.exe'\n            - '/opt/splunk/bin/splunkd'\n            - '/opt/splunk/bin/splunk'\n            - '/opt/splunkforwarder/bin/splunkd'\n            - '/opt/splunkforwarder/bin/splunk'\n    filter_razer:\n        Image|contains: '\\Razer\\RazerAppEngine\\'\n        Image|endswith: '\\razerappengine.exe'\n    condition: selection and not 1 of filter_*\nfalsepositives:\n    - >-\n        Razer App Engine (razerappengine.exe), which binds an unrelated local IPC service to port 8089.\n        Excluded above. Measured at 4,402 alerts over 14 days from a single host with no tunnel present.\n        Razer peripheral software is stock consumer tooling, so this collision occurs on any fleet that\n        permits the hardware.\n    - >-\n        Any other vendor or line-of-business software that binds port 8089 for its own local IPC. The port\n        is a Splunk convention, not a reservation, so this class is open-ended and the exclusion list will\n        need extending as new collisions are observed.\n    - Custom internal web services or developer tooling binding to port 8089 (verify against IT asset management)\n    - Other monitoring agents that use 8089 as a secondary management port\n    - >-\n        A single hit with no corresponding SSH, PuTTY or Plink reverse-tunnel establishment on the same host\n        (Sigma rule d49b3f9d-31e8-4ed8-8c62-87aba3aedd66). Treat as informational until corroborated.\nlevel: low",
        "to_ids": false,
        "comment": "Sigma Rule 10: Non-Splunk Process Connecting to Localhost Port 8089 | TIER: Hunting | robustness 1 | confidence MODERATE — port 8089 is not uniquely operator-specific. | ATT&CK T1572, T1021.004 | rule hash f710429e | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "8c06f827-732f-5300-830b-8f2a6bf0c89a",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Observability Platform API Authentication Event (Cross-Source Burst Building Block)\nid: b5756186-42bf-480c-b343-423a35d27336\nstatus: experimental\ndescription: >-\n  Detects an authentication event against one of four enterprise observability platforms\n  (IBM Instana, SolarWinds Orion, Zabbix, VMware Aria). This is a single-event building block:\n  the Turkish ARPA operator's Observability-Tool Reverse Pipeline TTP is defined by the SAME\n  source IP authenticating against 2 or more of these platforms within a 10-minute window,\n  which requires cross-event correlation that this per-event Sigma rule cannot itself express.\n  Deploy alongside a SIEM-native correlation counting distinct EventSource values per source IP\n  within a 10-minute window; a single match on this rule alone is common and not indicative of\n  malicious activity. (Corrected from the original rule, whose condition ANDed together four\n  selections that each require a different, mutually exclusive EventSource value on the SAME\n  event record — logic that could never evaluate true on any single log event.)\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\nmodified: '2026-10-11'\ntags:\n    - attack.stealth\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.t1078\n    - detection.emerging-threats\nlogsource:\n    product: generic\n    service: observability_audit\ndetection:\n    selection_instana:\n        EventSource: 'ibm_instana'\n        EventType: 'api_authentication'\n    selection_solarwinds:\n        EventSource: 'solarwinds_orion'\n        EventType: 'api_authentication'\n    selection_zabbix:\n        EventSource: 'zabbix'\n        EventType: 'api_login'\n    selection_vmware_aria:\n        EventSource: 'vmware_aria'\n        EventType: 'api_authentication'\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate SIEM/SOAR platforms collecting from multiple APM sources via centralized service accounts — a single hit is common and requires the companion cross-source correlation before treating as suspicious\n    - Any single legitimate authentication event to one of these platforms — this rule is a building block and should not be alerted on standalone\nlevel: low",
        "to_ids": false,
        "comment": "Sigma Rule 7: Observability Platform Authentication Event (Single-Event Building Block For Cross-Source Burst Correlation) | TIER: Hunting | robustness 1 | confidence MODERATE — requires SIEM correlation across multiple observability platform audit feeds to realize the full novel-TTP detection value. | ATT&CK T1078 | rule hash 4a31bd6c | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "2a078d01-cf63-5c42-b2ce-cb13c3625db5",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Outbound HTTPS to the Victim Organization OCP Instana Tenant\nid: 024cd785-789d-4a99-8098-439f87c1df17\nstatus: experimental\ndescription: >-\n  Detects outbound HTTPS connections to the the victim organization OCP-hosted Instana tenant\n  wildcard domain (*.ocpinstana.[victim-domain].com.tr). The Turkish ARPA operator harvested\n  victim observability data from this endpoint using a stolen 10-year-lifetime JWT. This\n  selection has no host-based filter — it fires identically for designated Instana operations\n  hosts and for unauthorized hosts — so hits must be triaged against the operations team\n  allow-list before escalation. Scoped to the victim organization's own environment; the\n  underlying hostname is excluded from the public IOC feed per the campaign's disclosure policy.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - attack.command-and-control\n    - attack.t1071.001\n    - attack.stealth\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.t1078\n    - detection.emerging-threats\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        DestinationHostname|endswith: '.ocpinstana.[victim-domain].com.tr'\n        DestinationPort: 443\n    condition: selection\nfalsepositives:\n    - Designated Instana operations team hosts performing authorized API queries — this rule does not distinguish them from unauthorized hosts and requires analyst triage against the allow-list\n    - Automated monitoring tools with legitimate access to the Instana tenant\nlevel: medium",
        "to_ids": false,
        "comment": "Sigma Rule 2: Outbound HTTPS to the Victim Organization Instana Tenant | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1071.001, T1078 | rule hash 6432a4e0 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "ef319224-77ba-5ce2-9b93-981e062e2b5c",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: PowerShell Command Line Containing An Instana Endpoint Name And SkipCertificateCheck\nid: ba31534e-e868-47fc-bfcd-4c5a4ce0b85d\nstatus: experimental\ndescription: >-\n  Detects PowerShell processes (powershell.exe or pwsh.exe) whose command-line text contains\n  an Instana reference (the host-name fragment ocpinstana or the operator's api/ingest/instana\n  path) and the text -SkipCertificateCheck. This is the command-line pattern of the\n  Turkish ARPA operator's victim-side collector (instana_local_collector.ps1) targeting the\n  the victim organization Instana tenant. The selection matches command-line text only: it\n  does not show that an endpoint was called or that certificate validation was disabled, it\n  tests no stored token, no bearer header and no specific tenant, and any tenant host name\n  containing ocpinstana, or any host with the ingest path, matches. A host not designated as an Instana operations system that\n  triggers this pattern is a lead to confirm against credential-based observability data\n  exfiltration.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.credential-access\n    - attack.t1552.001\n    - attack.command-and-control\n    - attack.t1071.001\n    - detection.emerging-threats\n    - stp.3\nlogsource:\n    category: process_creation\n    product: windows\n    definition: 'Requires process creation logging that populates Image and CommandLine, for example Sysmon EID 1 or Security EID 4688 with command line auditing enabled.'\ndetection:\n    selection_ps:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n    selection_instana:\n        CommandLine|contains:\n            - 'ocpinstana'\n            - 'api/ingest/instana'\n    selection_flags:\n        CommandLine|contains:\n            - '-SkipCertificateCheck'\n    condition: selection_ps and selection_instana and selection_flags\nfalsepositives:\n    - Legitimate Instana operations team scripts that use -SkipCertificateCheck for OCP self-signed certificates\n    - Authorized PowerShell monitoring automation targeting the same tenant endpoint\nlevel: medium",
        "to_ids": false,
        "comment": "Sigma Rule 1: PowerShell Command Line Containing An Instana Endpoint Name And SkipCertificateCheck | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1059.001, T1552.001, T1071.001 | rule hash 98129944 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "7488cd07-6028-552c-abfa-0f0302bb4c8e",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: PuTTY Saved Session Registry Value Write With ARPA_Tunnel In The Path\nid: 785967aa-4fba-4679-8209-53c0f22b0631\nstatus: experimental\ndescription: >-\n  Detects a registry value write under a PuTTY saved-session path that contains the\n  operator-distinctive session name ARPA_Tunnel. The Turkish ARPA operator instructed the\n  victim-side insider to create a PuTTY saved session named 'ARPA_Tunnel' targeting operator\n  VPS 209.38.205.158 with operator-supplied private key (rca_key.ppk). A value write under a\n  PuTTY session path containing ARPA_Tunnel is a lead for the insider deployment phase of\n  this campaign. The rule evaluates registry value-write events and tests the session name\n  in the path only; the substring can sit in a longer session name or a value name, and a\n  session saved with the operator IP under a different name is not matched.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - attack.command-and-control\n    - attack.t1572\n    - attack.lateral-movement\n    - attack.t1021.004\n    - detection.emerging-threats\n    - stp.2\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_putty_path:\n        TargetObject|contains: '\\Software\\SimonTatham\\PuTTY\\Sessions\\'\n    selection_arpa_session:\n        TargetObject|contains: 'ARPA_Tunnel'\n    condition: selection_putty_path and selection_arpa_session\nfalsepositives:\n    - Legitimate administrators creating PuTTY sessions for authorized remote management with similar names (verify session destination and key file)\nlevel: medium",
        "to_ids": false,
        "comment": "Sigma Rule 5: PuTTY Saved Session Registry Value Write Under A Path Containing ARPA_Tunnel | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1572, T1021.004 | rule hash d1a7bb1e | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "484484bf-e636-51a1-81b4-96a75ed7c970",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: SSH-Family Process Command Line Containing An ARPA Operator Marker\nid: 6465d373-414d-461d-8624-11153cc64d9c\nstatus: experimental\ndescription: >-\n  Detects an ssh.exe, putty.exe or plink.exe process whose command line contains any one of\n  five operator markers: the -R 18080: forward (with or without a space after -R), the\n  18080:localhost:8089 forward string, the Turkish ARPA operator's DigitalOcean VPS address\n  (209.38.205.158), the ARPA_Tunnel session name or the rca_key key-file name. The operator\n  provided the victim-side insider (Windows AD user [employee ID — suppressed]) with SSH keys\n  (rca_key.pem / rca_key.ppk) and instructions to deploy -R 18080:localhost:8089 tunnels, which\n  gives the operator live network access inside the victim's perimeter. Each marker is\n  sufficient on its own and the rule does not itself require a reverse forward, so rca_key\n  alone fires on any use of a key by that name. It tests no destination other than the\n  operator address, no user and no host role; a hit on the 18080 forward alone could be any\n  tunnel on that port.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - attack.command-and-control\n    - attack.t1572\n    - attack.lateral-movement\n    - attack.t1021.004\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1098.004\n    - detection.emerging-threats\n    - stp.2\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_ssh:\n        Image|endswith:\n            - '\\ssh.exe'\n            - '\\putty.exe'\n            - '\\plink.exe'\n    selection_tunnel:\n        CommandLine|contains:\n            - '-R 18080:'\n            - '-R18080:'\n            - '18080:localhost:8089'\n            - '209.38.205.158'\n    selection_arpa_session:\n        CommandLine|contains:\n            - 'ARPA_Tunnel'\n            - 'rca_key'\n    condition: selection_ssh and (selection_tunnel or selection_arpa_session)\nfalsepositives:\n    - Authorized developer tunneling tools with similar flag patterns (verify against endpoint management)\n    - Legitimate reverse-tunnel software for remote support (verify endpoint ownership and destination IP)\nlevel: medium",
        "to_ids": false,
        "comment": "Sigma Rule 4: SSH-Family Process Command Line Containing An ARPA Operator Marker | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1572, T1021.004, T1098.004 | rule hash c89d1c49 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "3f4a8db3-8e61-5975-8b59-9e0ee62dc53f",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: SSH-Family Process With A Reverse-Forward Flag Outside Private-Range Substrings\nid: d49b3f9d-31e8-4ed8-8c62-87aba3aedd66\nstatus: experimental\ndescription: >-\n  Detects ssh.exe, putty.exe or plink.exe processes whose command line contains the -R\n  reverse-forwarding flag and none of the substrings 10., 172. or 192.168. The substring\n  exclusion is a loose stand-in for an external destination, not a CIDR or address test: it\n  also excludes an external address that merely contains one of those substrings, and it\n  does not test a hostname destination. The rule tests no AD membership, no user and no\n  host role. In the Turkish ARPA operator campaign, an insider (Windows AD user [employee ID —\n  suppressed]) was supplied with operator-provided SSH keys and instructions to establish\n  reverse tunnels from inside the victim organization's network to 209.38.205.158:18080.\n  A reverse forward from an enterprise workstation is a hunting lead for insider-facilitated\n  external access regardless of the specific destination, but requires triage against\n  authorized developer tunneling use.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - attack.command-and-control\n    - attack.t1572\n    - attack.lateral-movement\n    - attack.t1021.004\n    - detection.emerging-threats\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_ssh_tools:\n        Image|endswith:\n            - '\\ssh.exe'\n            - '\\putty.exe'\n            - '\\plink.exe'\n    selection_reverse_flag:\n        CommandLine|contains:\n            - ' -R '\n    filter_authorized_infra:\n        CommandLine|contains:\n            - '10.'\n            - '172.'\n            - '192.168.'\n    condition: selection_ssh_tools and selection_reverse_flag and not filter_authorized_infra\nfalsepositives:\n    - Authorized developers using reverse SSH tunnels for remote development (verify against IT-authorized tunneling policy and destination IP allow-list)\n    - Remote support tools using SSH tunneling to authorized jump hosts\nlevel: medium",
        "to_ids": false,
        "comment": "Sigma Rule 12: SSH, PuTTY Or Plink Process With A -R Reverse-Forward Flag, Excluding Private-Range Substrings | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1572, T1021.004 | rule hash e21b5c7c | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "8a533bed-d12b-5896-bc95-ab2b2de76d5a",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Systemd Unit File Created with ARPA Platform Service Naming Convention\nid: 4c27b8f2-a383-4cf0-a20a-21f8681231fa\nstatus: experimental\ndescription: >-\n  Detects creation of systemd unit files matching the Turkish ARPA operator's distinctive\n  arpa-* naming pattern in /etc/systemd/system/. The operator deployed five service units\n  (arpa-autolearn, arpa-continuous, arpa-daemon, arpa-instana-api, arpa-parallel) to persist\n  the ARPA observability-harvester platform across reboots. This naming pattern has not been\n  observed in legitimate software in any known deployment context. File creation events matching\n  this pattern on any Linux host are a lead for ARPA platform deployment; the prefix is an\n  operator-chosen name, so a rename evades the rule.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\nauthor: The Hunters Ledger\ndate: '2026-05-26'\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1543.002\n    - attack.execution\n    - attack.t1569.002\n    - detection.emerging-threats\n    - stp.2\nlogsource:\n    category: file_event\n    product: linux\ndetection:\n    selection:\n        TargetFilename|startswith: '/etc/systemd/system/arpa-'\n        TargetFilename|endswith: '.service'\n    condition: selection\nfalsepositives:\n    - Custom in-house monitoring software using the arpa- service name prefix (unlikely; verify with IT asset management)\n    - Legitimate open-source software with arpa- prefixed services (no known examples as of 2026-05-26)\nlevel: medium",
        "to_ids": false,
        "comment": "Sigma Rule 3: Systemd Unit Creation Matching `arpa-*` Naming Pattern | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1543.002, T1569.002 | rule hash 8649fedd | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "f263afbf-3926-5775-9928-a4a141f1752c",
        "type": "yara",
        "category": "Payload installation",
        "value": "/*\n   Yara Rule Set\n   Identifier: Turkish-ARPA-OpenClaw-State-Insurer-209.38.205.158\n   Author: The Hunters Ledger\n   Source: https://the-hunters-ledger.com/\n   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule MAL_PowerShell_Instana_Local_Collector_Family {\n   meta:\n      description = \"Detects the Turkish ARPA operator's victim-side PowerShell collector that exfiltrates IBM Instana APM events from the victim organization's OCP-hosted Instana tenant to operator C2 at 209.38.205.158. Indicators: hardcoded victim Instana endpoint, stolen JWT delivery, Turkish-language operational comments, and POST to operator ARPA ingestion endpoint.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\"\n      date = \"2026-05-26\"\n      family = \"ARPA-observability-harvester\"\n      malware_type = \"observability-credential-harvester\"\n      campaign = \"Turkish-ARPA-State-Insurer-209.38.205.158\"\n      id = \"8fd415cd-73c0-5027-b5e3-be299bbec061\"\n   strings:\n      $victim_endpoint = \"ocpinstana.[victim-domain].com.tr\" ascii wide\n      $operator_c2 = \"api/ingest/instana\" ascii wide fullword\n      $skip_cert = \"-SkipCertificateCheck\" ascii wide fullword\n      $turkish_comment = \"Bu script local Windows makinede\" ascii wide\n      $arpa_server = \"ARPA sunucusuna gonderiliyor\" ascii wide\n      $event_schema = \"entity_type\" ascii wide fullword\n   condition:\n      filesize < 50KB and\n      $victim_endpoint and $operator_c2 and $skip_cert and\n      (1 of ($turkish_comment, $arpa_server) or $event_schema)\n}",
        "to_ids": true,
        "comment": "Rule 1: PowerShell Instana Local Collector | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1059.001, T1552.001, T1020, T1071.001 | rule hash fc279909 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "08d9e72d-ce9a-53bd-9021-a1d1a8399bb6",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule MAL_Markdown_ARPA_OperatorNote_Family {\n   meta:\n      description = \"Detects Turkish ARPA operator-authored operational Markdown notes (GERCEK_API_BULUNDU.md, INSTANA_INTEGRATION_SUMMARY.md class). Operator documents the discovery of victim Instana endpoints, integration steps, and references the public MehmetARPA/ARPA GitHub repository. Turkish-language operational narrative combined with victim-specific API references is operator-distinctive.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\"\n      date = \"2026-05-26\"\n      family = \"ARPA-observability-harvester\"\n      malware_type = \"operator-ops-note\"\n      campaign = \"Turkish-ARPA-State-Insurer-209.38.205.158\"\n      id = \"3369e5c8-06a2-5589-87c2-e26074c0dca3\"\n   strings:\n      $gercek = \"GERCEK_API_BULUNDU\" ascii wide\n      $github_ref = \"MehmetARPA/ARPA\" ascii wide\n      $instana_summary = \"INSTANA_INTEGRATION_SUMMARY\" ascii wide\n      $instana_port = \"INSTANA_PORT_TEST\" ascii wide\n      $victim_ref = \"[victim-tenant]\" ascii wide nocase\n      $api_token_label = \"apiToken\" ascii wide fullword\n      $turkish_label = \"Instana API Test\" ascii wide\n   condition:\n      filesize < 200KB and\n      ($gercek or $instana_summary or $github_ref or $instana_port) and\n      ($victim_ref or $api_token_label or $turkish_label)\n}",
        "to_ids": true,
        "comment": "Rule 7: ARPA Operator Ops Notes Markdown Family | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1587, T1552.001 | rule hash a54c9dcc | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "56729246-870f-5db8-bd53-e015100bf26e",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule MAL_PSScript_Insider_TunnelSetup_Turkish {\n   meta:\n      description = \"Detects operator-authored Turkish-language insider-recruitment tunnel-setup documents (Markdown or text files under 200KB), matched on two tunnel markers plus one of four document-name strings: PUTTY_TUNNEL_DETAY, SSH_KEY_COZUM, WINDOWS_VPN_TUNNEL and GERCEK_API_BULUNDU. TUNNEL_RESTART.md, also in the operator's document set, has no string in this rule. Operator instructs victim-side insider (the victim organization Windows AD user [employee ID — suppressed]) how to deploy reverse SSH tunnels from inside the victim network. Keyword combination is specific to this operator campaign. The rule identifier keeps the legacy PSScript token for deployment continuity; the rule tests no script type and matches the documents, not PowerShell scripts.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\"\n      date = \"2026-05-26\"\n      family = \"ARPA-observability-harvester\"\n      malware_type = \"insider-recruitment-document\"\n      campaign = \"Turkish-ARPA-State-Insurer-209.38.205.158\"\n      id = \"3f787a25-bfd5-5e85-9009-0cedba0a5c1d\"\n   strings:\n      $tk1 = \"ARPA_Tunnel\" ascii wide fullword\n      $tk2 = \"rca_key.ppk\" ascii wide fullword\n      $tk3 = \"rca_key.pem\" ascii wide fullword\n      $tk4 = \"209.38.205.158\" ascii wide\n      $tk5 = \"18080:localhost:8089\" ascii wide\n      $tk6 = \"SSH_KEY_COZUM\" ascii wide\n      $tk7 = \"PUTTY_TUNNEL_DETAY\" ascii wide\n      $tk8 = \"WINDOWS_VPN_TUNNEL\" ascii wide\n      $tk9 = \"GERCEK_API_BULUNDU\" ascii wide\n   condition:\n      filesize < 200KB and\n      2 of ($tk1, $tk2, $tk3, $tk4, $tk5) and\n      1 of ($tk6, $tk7, $tk8, $tk9)\n}",
        "to_ids": true,
        "comment": "Rule 3: Insider Tunnel-Setup Turkish-Language Operator Document | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1572, T1098.004, T1021.004 | rule hash 4dc9adac | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "20f7aeeb-c144-5f11-b8b5-b10c3a995d23",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule MAL_Python_ARPA_AI_Service_NaturalLanguage_Query {\n   meta:\n      description = \"Detects the Turkish ARPA operator's AI-augmented natural-language query interface over stolen observability data: the ai_assistant.db name (always required) plus one handler, training-log or situations marker plus one of the /opt/ARPA/ai/ path, data_retrieval.py or ai_service.py (ai_service.py is one alternative, not a requirement). Architecture: events table populated from stolen Instana monitoring data, situations table for AI root-cause analysis, ai_training_log table for conversation feedback. Candidate novel TTP: AI-Augmented Infrastructure Reconnaissance Using Stolen APM Credentials.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\"\n      date = \"2026-05-26\"\n      family = \"ARPA-observability-harvester\"\n      malware_type = \"ai-augmented-reconnaissance\"\n      campaign = \"Turkish-ARPA-State-Insurer-209.38.205.158\"\n      id = \"bcc21a4e-4647-57ec-be62-c2c1b1d055c4\"\n   strings:\n      $ai_db = \"ai_assistant.db\" ascii wide fullword\n      $ai_service = \"ai_service.py\" ascii wide fullword\n      $data_retrieval = \"data_retrieval.py\" ascii wide fullword\n      $handler1 = \"_handle_event_query\" ascii wide fullword\n      $handler2 = \"_handle_general_query\" ascii wide fullword\n      $ai_training = \"ai_training_log\" ascii wide fullword\n      $situations = \"situations\" ascii wide fullword\n      $arpa_path = \"/opt/ARPA/ai/\" ascii wide\n   condition:\n      filesize < 500KB and\n      $ai_db and\n      ($handler1 or $handler2 or $ai_training or $situations) and\n      ($arpa_path or $data_retrieval or $ai_service)\n}",
        "to_ids": false,
        "comment": "Rule 5: ARPA AI Service Natural-Language Query Interface | TIER: Hunting | robustness 2 | confidence MODERATE — the AI service was observed in a broken/dev state on the single analyzed host; the pattern may not have replicated to other deployments. | ATT&CK T1059.006, T1213 | rule hash d9cb4e21 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "34607e8c-be2f-5bd2-8af5-94ff6d96e0b1",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule MAL_Python_ARPA_CrossSource_Correlation_ETL {\n   meta:\n      description = \"Detects the Turkish ARPA operator's cross-source correlation ETL engine (correlation_v3.py and variants). Operator self-branded docstring 'ARPA Korelasyon Motoru v3 - Temporal Focus', Turkish-language diagnostic output, and API endpoint dispatch patterns uniquely identify this component of the ARPA platform.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\"\n      date = \"2026-05-26\"\n      modified = \"2026-10-10\"\n      family = \"ARPA-observability-harvester\"\n      malware_type = \"observability-credential-harvester\"\n      campaign = \"Turkish-ARPA-State-Insurer-209.38.205.158\"\n      id = \"c6216184-81e7-5bf2-bd8b-4177ed18a036\"\n   strings:\n      $docstring = \"ARPA Korelasyon Motoru v3\" ascii wide\n      $turkish_diag = \"=== SON 5 KORELASYON ===\" ascii wide\n      $endpoint_dispatch = \"/api/correlations/\" ascii wide fullword\n      $temporal = \"Temporal Focus\" ascii wide fullword\n      $topology_fn = \"topology_mapper.py\" ascii wide fullword\n      $extract_fn = \"extract_host_from_label\" ascii wide fullword\n      $turkish_extract = \"Service label\" ascii wide\n   condition:\n      filesize < 2MB and\n      ($docstring or $turkish_diag) and\n      ($endpoint_dispatch or $topology_fn or ($extract_fn and $turkish_extract) or ($docstring and $temporal))\n}",
        "to_ids": true,
        "comment": "Rule 6: ARPA Cross-Source Correlation ETL Engine | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1059.006, T1119, T1005 | rule hash f197cf2b | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "827a2b1f-d28d-5136-8d52-85bd8e9a5a34",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule MAL_Python_ARPA_Observability_Harvester_Platform {\n   meta:\n      description = \"Detects the Turkish ARPA operator's multi-source observability-harvester Python platform (ARPA Korelasyon Motoru). Targets the operator self-branding docstring, dashboard footer, and multi-source ingestion patterns that identify this platform across source files, SQLite stores, and HTML dashboard responses.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\"\n      date = \"2026-05-26\"\n      family = \"ARPA-observability-harvester\"\n      malware_type = \"observability-credential-harvester\"\n      campaign = \"Turkish-ARPA-State-Insurer-209.38.205.158\"\n      id = \"6ffe1dfa-a552-578c-b83c-1330dab61d55\"\n   strings:\n      $brand1 = \"ARPA Korelasyon Motoru\" ascii wide\n      $brand2 = \"ARPA \\xC2\\xA9 2026\" ascii wide\n      $brand3 = \"Read-Only Compliance\" ascii wide fullword\n      $mock_data = \"Mock Data: \\xE2\\x9D\\x8C\" ascii\n      $db_collector = \"/opt/ARPA/data/collector.db\" ascii wide\n      $db_ai = \"ai_assistant.db\" ascii wide fullword\n      $corr_endpoint = \"/api/correlations/\" ascii wide fullword\n      $topology_endpoint = \"/api/topology/unified\" ascii wide\n   condition:\n      filesize < 5MB and\n      (\n         ($brand2 and $brand3 and $mock_data) or\n         (\n            ($brand1 or $brand2) and\n            ($corr_endpoint or $topology_endpoint or $db_collector or $db_ai)\n         )\n      )\n}",
        "to_ids": true,
        "comment": "Rule 2: ARPA Observability Harvester Platform | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1059.006, T1119, T1543.002, T1071.001 | rule hash 4be48da4 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "b2e902ed-dd82-52fa-bb5d-e2fd2481049f",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule MAL_Python_Instana_SolarWinds_Zabbix_VMwareAria_Polling {\n   meta:\n      description = \"Detects files (the operator's polling script is Python, but no Python marker is tested) that carry the victim's Instana tenant identifier together with one of three alternatives: the stolen JWT's jti value; the Instana events API path plus two of three competing-platform references (zabbix, solarwinds, vmware); or the 5-minute cadence marker plus the get_last_fetch_time function name. Only the second alternative reflects a multi-platform poller; the jti and cadence alternatives need no second platform. The operator's multi-source polling script (IBM Instana, SolarWinds Orion, Zabbix, VMware Aria from a single codebase) is the core of the Turkish ARPA operator's Observability-Tool Reverse Pipeline TTP.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\"\n      date = \"2026-05-26\"\n      family = \"ARPA-observability-harvester\"\n      malware_type = \"observability-credential-harvester\"\n      campaign = \"Turkish-ARPA-State-Insurer-209.38.205.158\"\n      id = \"7b048278-a144-592a-ac98-b703145488ca\"\n   strings:\n      $instana_tenant = \"[victim-tenant]\" ascii wide fullword\n      $instana_api = \"api/events?from=\" ascii wide\n      $zabbix_ref = \"zabbix\" ascii wide nocase fullword\n      $solarwinds_ref = \"solarwinds\" ascii wide nocase fullword\n      $vmware_aria = \"vmware\" ascii wide nocase fullword\n      $cadence = \"5min\" ascii wide fullword\n      $jwt_jti = \"[stolen-token-jti]\" ascii wide\n      $last_fetch = \"get_last_fetch_time\" ascii wide fullword\n   condition:\n      filesize < 500KB and\n      $instana_tenant and\n      (\n         $jwt_jti or\n         ($instana_api and 2 of ($zabbix_ref, $solarwinds_ref, $vmware_aria)) or\n         ($cadence and $last_fetch)\n      )\n}",
        "to_ids": false,
        "comment": "Rule 4: Victim Instana Tenant String With Stolen-JWT, Multi-Platform Or Cadence Markers (Operator Polling Script) | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1059.006, T1046, T1119, T1078 | rule hash 0059e7f4 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "bd78969a-5ff0-52a4-9652-b1849c6a9e89",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule MAL_SystemdUnit_ARPA_Platform_Services {\n   meta:\n      description = \"Detects the Turkish ARPA operator's systemd service unit files persisting the ARPA observability-harvester platform (arpa-autolearn, arpa-continuous, arpa-daemon, arpa-instana-api, arpa-parallel). Presence of this naming cluster in /etc/systemd/system/ indicates ARPA platform deployment on the target host.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/\"\n      date = \"2026-05-26\"\n      family = \"ARPA-observability-harvester\"\n      malware_type = \"observability-credential-harvester\"\n      campaign = \"Turkish-ARPA-State-Insurer-209.38.205.158\"\n      id = \"4e1c0388-5ccf-57e5-bbfe-06500eaf6974\"\n   strings:\n      $svc1 = \"arpa-autolearn\" ascii wide fullword\n      $svc2 = \"arpa-continuous\" ascii wide fullword\n      $svc3 = \"arpa-daemon\" ascii wide fullword\n      $svc4 = \"arpa-instana-api\" ascii wide fullword\n      $svc5 = \"arpa-parallel\" ascii wide fullword\n      $execstart = \"ExecStart=\" ascii wide\n      $opt_arpa = \"/opt/ARPA/\" ascii wide\n   condition:\n      filesize < 10KB and\n      2 of ($svc1, $svc2, $svc3, $svc4, $svc5) and\n      ($execstart or $opt_arpa)\n}",
        "to_ids": true,
        "comment": "Rule 8: ARPA Platform Systemd Service Units | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1543.002, T1569.002 | rule hash 80c34228 | https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
        "timestamp": 1792180054,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      }
    ],
    "Object": []
  }
}