{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "The Hunter's Ledger: Detection Rules",
  "home_page_url": "https://the-hunters-ledger.com/hunting-detections/",
  "feed_url": "https://the-hunters-ledger.com/hunting-detections/feed.json",
  "description": "Sigma, YARA and Suricata detection rules from original research, one page per campaign, licensed CC BY 4.0.",
  "icon": "https://the-hunters-ledger.com/assets/images/apple-touch-icon.png",
  "favicon": "https://the-hunters-ledger.com/assets/images/favicon.svg",
  "language": "en",
  "authors": [{ "name": "The Hunter's Ledger", "url": "https://the-hunters-ledger.com" }],
  "items": [
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/newdouble-clickfix-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/newdouble-clickfix-detections/",
      "title": "Detection Rules: newdouble ClickFix fake-verification chain to a Steam-focused executable",
      "summary": "**Campaign:** Newdouble-ClickFix-202.71.14.31\n**Date:** 2026-09-28\n**Author:** The Hunters Ledger\n**License:** CC BY 4.0\n**Reference:** https://the-hunters-ledger.com/reports/newdouble-clickfix/\n\n---\n\n## Detection Coverage Summary\n\n| Rule Type | Detection | Hunting | MITRE Techniques Covered | Atomics → feed |\n|---|---|---|---|---|\n| YARA | 0 | 3 | T1185, T1041 | 0 |\n| Sigma | 0 | 6 | T1059.001, T1204.004, T1685, T1557, T1553.004, T1185 | 1 |\n| Suricata | 0 | 5 | T1105, T1204.004, T1041 | 0 |...",
      "content_text": "**Campaign:** Newdouble-ClickFix-202.71.14.31\n**Date:** 2026-09-28\n**Author:** The Hunters Ledger\n**License:** CC BY 4.0\n**Reference:** https://the-hunters-ledger.com/reports/newdouble-clickfix/\n\n---\n\n## Detection Coverage Summary\n\n| Rule Type | Detection | Hunting | MITRE Techniques Covered | Atomics → feed |\n|---|---|---|---|---|\n| YARA | 0 | 3 | T1185, T1041 | 0 |\n| Sigma | 0 | 6 | T1059.001, T1204.004, T1685, T1557, T1553.004, T1185 | 1 |\n| Suricata | 0 | 5 | T1105, T1204.004, T1041 | 0 |...",
      "date_published": "2026-09-28T00:00:00+00:00",
      "date_modified": "2026-09-28T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
      "title": "Detection Rules — Gotenberg RCE Mass Exploitation and Cryptomining",
      "summary": "**Campaign:** Gotenberg-RCE-107.175.69.137\n**Date:** 2026-09-16\n**Author:** The Hunters Ledger\n**License:** CC BY 4.0\n**Reference:** https://the-hunters-ledger.com/reports/gotenberg-rce-cryptomining-107-175-69-137/\n\n---\n\n## Detection Coverage Summary\n\n| Rule Type | Detection | Hunting | MITRE Techniques Covered | Atomics → feed |\n|---|---|---|---|---|\n| YARA | 0 | 0 | none (see Coverage Gaps) | 0 |\n| Sigma | 4 | 3 | T1190, T1059.004, T1036.005, T1543.002, T1140 | 0 |\n| Suricata | 1 | 3 | T119...",
      "content_text": "**Campaign:** Gotenberg-RCE-107.175.69.137\n**Date:** 2026-09-16\n**Author:** The Hunters Ledger\n**License:** CC BY 4.0\n**Reference:** https://the-hunters-ledger.com/reports/gotenberg-rce-cryptomining-107-175-69-137/\n\n---\n\n## Detection Coverage Summary\n\n| Rule Type | Detection | Hunting | MITRE Techniques Covered | Atomics → feed |\n|---|---|---|---|---|\n| YARA | 0 | 0 | none (see Coverage Gaps) | 0 |\n| Sigma | 4 | 3 | T1190, T1059.004, T1036.005, T1543.002, T1140 | 0 |\n| Suricata | 1 | 3 | T119...",
      "date_published": "2026-09-16T00:00:00+00:00",
      "date_modified": "2026-09-16T00:00:00+00:00",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/sliver-c2-windows-postex-staging-193-233-202-17-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/sliver-c2-windows-postex-staging-193-233-202-17-detections/",
      "title": "Detection Rules — Sliver C2 Windows Post-Exploitation Staging, 193.233.202.17",
      "summary": "Hunting and detection rules for Sliver C2 Windows post-exploitation staging (193.233.202.17). 4 YARA, 12 Sigma and 2 Suricata rules.",
      "content_text": "Hunting and detection rules for Sliver C2 Windows post-exploitation staging (193.233.202.17). 4 YARA, 12 Sigma and 2 Suricata rules.",
      "date_published": "2026-09-06T00:00:00+00:00",
      "date_modified": "2026-09-06T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/sliver-c2-windows-postex-staging-193-233-202-17.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817-detections/",
      "title": "Detection Rules: WebLogic Deserialization and Telecom Credential Harvesting, 13.140.145.210",
      "summary": "Hunting and detection rules for a WebLogic deserialization telecom harvester toolkit (13.140.145.210). 8 YARA, 11 Sigma, 12 Suricata rules.",
      "content_text": "Hunting and detection rules for a WebLogic deserialization telecom harvester toolkit (13.140.145.210). 8 YARA, 11 Sigma, 12 Suricata rules.",
      "date_published": "2026-08-18T00:00:00+00:00",
      "date_modified": "2026-08-18T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
      "title": "Detection Rules: CloudSync Assembler Toolkit",
      "summary": "Detection rules for the CloudSync assembler toolkit, a five-part intrusion set. Seven YARA, eighteen Sigma and four Suricata rules by component.",
      "content_text": "Detection rules for the CloudSync assembler toolkit, a five-part intrusion set. Seven YARA, eighteen Sigma and four Suricata rules by component.",
      "date_published": "2026-08-03T00:00:00+00:00",
      "date_modified": "2026-08-03T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/cloudsync-assembler-toolkit-91-197-98-188.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/",
      "title": "Detection Rules — GOCLOUD Multi-Service Cryptojacking",
      "summary": "Detection rules for GOCLOUD two-node cryptojacking operation and orchestrator. Seven YARA, eleven Sigma and five Suricata behavior rules.",
      "content_text": "Detection rules for GOCLOUD two-node cryptojacking operation and orchestrator. Seven YARA, eleven Sigma and five Suricata behavior rules.",
      "date_published": "2026-07-26T00:00:00+00:00",
      "date_modified": "2026-07-26T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/gocloud-multiservice-cryptojacking-149-28-112-221.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/multivector-ecommerce-rce-toolkit-192-3-1-116-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/multivector-ecommerce-rce-toolkit-192-3-1-116-detections/",
      "title": "Detection Rules: MultiVector Grey-Market PII Harvesting Operation (192.3.1.116)",
      "summary": "Hunting and detection rules for the MultiVector ecommerce RCE toolkit operator (192.3.1.116). 5 YARA, 12 Sigma and 13 Suricata rules.",
      "content_text": "Hunting and detection rules for the MultiVector ecommerce RCE toolkit operator (192.3.1.116). 5 YARA, 12 Sigma and 13 Suricata rules.",
      "date_published": "2026-07-21T00:00:00+00:00",
      "date_modified": "2026-07-21T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/multivector-ecommerce-rce-toolkit-192-3-1-116.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/",
      "title": "Detection Rules: SE-Asia Government Exploitation Toolkit (144.172.106.236)",
      "summary": "Hunting and detection rules for a government-targeting exploitation toolkit (144.172.106.236). 6 YARA, 15 Sigma and 8 Suricata rules.",
      "content_text": "Hunting and detection rules for a government-targeting exploitation toolkit (144.172.106.236). 6 YARA, 15 Sigma and 8 Suricata rules.",
      "date_published": "2026-07-17T00:00:00+00:00",
      "date_modified": "2026-07-17T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/seasia-gov-exploitation-toolkit-144-172-106-236.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/kaido-quasar-rat-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/kaido-quasar-rat-detections/",
      "title": "Detection Rules — KAIDO Quasar-Fork RAT",
      "summary": "Detection rules for KAIDO, a Quasar RAT fork with hidden desktop browser theft. Three YARA, three Sigma and two Suricata rules included.",
      "content_text": "Detection rules for KAIDO, a Quasar RAT fork with hidden desktop browser theft. Three YARA, three Sigma and two Suricata rules included.",
      "date_published": "2026-07-03T00:00:00+00:00",
      "date_modified": "2026-07-03T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/kaido-quasar-rat-144-172-109-203.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/evilsoul-engine-stealer-maas-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/evilsoul-engine-stealer-maas-detections/",
      "title": "Detection Rules — EvilSoul-Engine Stealer-Builder MaaS",
      "summary": "Detection rules for EvilSoul-Engine stealer-builder kits and panels. Five YARA, six Sigma and one Suricata rule for builder constants.",
      "content_text": "Detection rules for EvilSoul-Engine stealer-builder kits and panels. Five YARA, six Sigma and one Suricata rule for builder constants.",
      "date_published": "2026-07-03T00:00:00+00:00",
      "date_modified": "2026-07-03T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/evilsoul-engine-stealer-maas-144-172-103-98.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/",
      "title": "Detection Rules: FlaskC2-PostEx-Toolkit-67.215.232.25",
      "summary": "Detection rules for a Flask C2 panel, SQL-CLR backdoor and webshells. Four YARA, six Sigma and three Suricata rules for staged tools.",
      "content_text": "Detection rules for a Flask C2 panel, SQL-CLR backdoor and webshells. Four YARA, six Sigma and three Suricata rules for staged tools.",
      "date_published": "2026-06-12T00:00:00+00:00",
      "date_modified": "2026-06-12T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/flaskc2-postex-toolkit-67-215-232-25.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/",
      "title": "Detection Rules — Korean Claude Code Allowlist + OpenClaw Operator (221.150.15.104)",
      "summary": "Detection rules for Korean Claude Code OpenClaw operator config abuse (221.150.15.104). Two YARA and four Sigma rules on allowlist behavior.",
      "content_text": "Detection rules for Korean Claude Code OpenClaw operator config abuse (221.150.15.104). Two YARA and four Sigma rules on allowlist behavior.",
      "date_published": "2026-05-27T00:00:00+00:00",
      "date_modified": "2026-05-27T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/korean-claude-openclaw-221.150.15.104.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/",
      "title": "Detection Rules — Turkish ARPA Operator / AI-Augmented State-Insurer Observability Compromise + Insider Recruitment (UTA-2026-013)",
      "summary": "Hunting and detection rules for the Turkish ARPA state-insurer observability compromise (209.38.205.158). 8 YARA, 11 Sigma, 2 Suricata rules.",
      "content_text": "Hunting and detection rules for the Turkish ARPA state-insurer observability compromise (209.38.205.158). 8 YARA, 11 Sigma, 2 Suricata rules.",
      "date_published": "2026-05-26T00:00:00+00:00",
      "date_modified": "2026-05-26T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/turkish-arpa-openclaw-state-insurer-209.38.205.158.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/rovodev-mirai-matrix-c2-87.106.143.220-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/rovodev-mirai-matrix-c2-87.106.143.220-detections/",
      "title": "Detection Rules — Rovodev AI Co-Authored Pandora-Mirai Variant + Matrix C2 Framework",
      "summary": "Hunting and detection rules for a Rovodev AI-built Mirai variant with Matrix C2. 10 YARA, 10 Sigma and 10 Suricata rules on bots.",
      "content_text": "Hunting and detection rules for a Rovodev AI-built Mirai variant with Matrix C2. 10 YARA, 10 Sigma and 10 Suricata rules on bots.",
      "date_published": "2026-05-26T00:00:00+00:00",
      "date_modified": "2026-05-26T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/rovodev-mirai-matrix-c2-87.106.143.220.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/",
      "title": "Detection Rules — Russian Gemini Credential Mill (213.165.51.115)",
      "summary": "Hunting and detection rules for a Gemini-augmented credential mill with custom Python A2A C2. 8 YARA, 10 Sigma and 2 Suricata rules.",
      "content_text": "Hunting and detection rules for a Gemini-augmented credential mill with custom Python A2A C2. 8 YARA, 10 Sigma and 2 Suricata rules.",
      "date_published": "2026-05-25T00:00:00+00:00",
      "date_modified": "2026-05-25T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/russian-gemini-credential-mill-213.165.51.115.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/ghost-cryptojacker-vova75rus-77.110.96.200-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/ghost-cryptojacker-vova75rus-77.110.96.200-detections/",
      "title": "Detection Rules — GHOST Cryptojacker Kit Family (Vova75Rus / 77.110.96.200)",
      "summary": "Detection rules for GHOST cryptojacker kits by Vova75Rus with rootkit and tunnel parts. Nine YARA, ten Sigma, three Suricata rules.",
      "content_text": "Detection rules for GHOST cryptojacker kits by Vova75Rus with rootkit and tunnel parts. Nine YARA, ten Sigma, three Suricata rules.",
      "date_published": "2026-05-25T00:00:00+00:00",
      "date_modified": "2026-05-25T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/ghost-cryptojacker-vova75rus-77.110.96.200.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/",
      "title": "Detection Rules — AI-Agent Framework Abuse Campaign (Multi-Actor, 2026-05-23)",
      "summary": "Detection rules for multi-actor AI-agent framework abuse across 8 operators. Eight YARA, fourteen Sigma and eight Suricata rules for broad coverage.",
      "content_text": "Detection rules for multi-actor AI-agent framework abuse across 8 operators. Eight YARA, fourteen Sigma and eight Suricata rules for broad coverage.",
      "date_published": "2026-05-25T00:00:00+00:00",
      "date_modified": "2026-05-25T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/ai-agent-frameworks-2026-05-23.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/",
      "title": "Detection Rules — CVE-2026-41940 cPanel Harvester Toolkit — 216.126.227.49",
      "summary": "Detection rules for CVE-2026-41940 cPanel auth-bypass exploitation and harvester tooling. 1 YARA, 7 Sigma hunting and 2 Suricata rules.",
      "content_text": "Detection rules for CVE-2026-41940 cPanel auth-bypass exploitation and harvester tooling. 1 YARA, 7 Sigma hunting and 2 Suricata rules.",
      "date_published": "2026-05-17T00:00:00+00:00",
      "date_modified": "2026-05-17T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/inkognito-russian-vpn-phishing-185-221-196-118-20260516-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/inkognito-russian-vpn-phishing-185-221-196-118-20260516-detections/",
      "title": "Detection Rules — Inkognito Russian VPN Phishing & Brand-Impersonation Infrastructure",
      "summary": "Detection rules for Inkognito VPN phishing and brand impersonation sites. Two YARA, one Sigma and two Suricata rules for web assets.",
      "content_text": "Detection rules for Inkognito VPN phishing and brand impersonation sites. Two YARA, one Sigma and two Suricata rules for web assets.",
      "date_published": "2026-05-16T00:00:00+00:00",
      "date_modified": "2026-05-16T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/inkognito-russian-vpn-phishing-185-221-196-118-20260516.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    },
    {
      "id": "https://the-hunters-ledger.com/hunting-detections/bellamain-turkish-phaas-79-137-192-3-20260516-detections/",
      "url": "https://the-hunters-ledger.com/hunting-detections/bellamain-turkish-phaas-79-137-192-3-20260516-detections/",
      "title": "Detection Rules — BellaMain Turkish PhaaS Panel",
      "summary": "Detection rules for BellaMain Turkish phishing panel and brand kits. Three YARA, five Sigma and one Suricata rule for server-side artifacts.",
      "content_text": "Detection rules for BellaMain Turkish phishing panel and brand kits. Three YARA, five Sigma and one Suricata rule for server-side artifacts.",
      "date_published": "2026-05-16T00:00:00+00:00",
      "date_modified": "2026-05-16T00:00:00+00:00",
      "image": "https://the-hunters-ledger.com/assets/images/cards/bellamain-turkish-phaas-79-137-192-3-20260516.png",
      "authors": [{ "name": "Joseph Harrison", "url": "https://the-hunters-ledger.com/about-me/" }]
    }
  ]
}