Sigma, YARA and Suricata detection rules from original research, one page per campaign, licensed CC BY 4.0. Supported by Hunt.io. 2026-10-19T22:03:53+00:00 https://the-hunters-ledger.com/hunting-detections/ The Hunter's Ledger https://the-hunters-ledger.com 2026-09-28T00:00:00+00:00 2026-09-28T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/newdouble-clickfix-detections/ The Hunter's Ledger https://the-hunters-ledger.com

**Campaign:** Newdouble-ClickFix-202.71.14.31 **Date:** 2026-09-28 **Author:** The Hunters Ledger **License:** CC BY 4.0 **Reference:** https://the-hunters-ledger.com/reports/newdouble-clickfix/ --- ## Detection Coverage Summary | Rule Type | Detection | Hunting | MITRE Techniques Covered | Atomics → feed | |---|---|---|---|---| | YARA | 0 | 3 | T1185, T1041 | 0 | | Sigma | 0 | 6 | T1059.001, T1204.004, T1685, T1557, T1553.004, T1185 | 1 | | Suricata | 0 | 5 | T1105, T1204.004, T1041 | 0 |...

2026-09-16T00:00:00+00:00 2026-09-16T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/ The Hunter's Ledger https://the-hunters-ledger.com

**Campaign:** Gotenberg-RCE-107.175.69.137 **Date:** 2026-09-16 **Author:** The Hunters Ledger **License:** CC BY 4.0 **Reference:** https://the-hunters-ledger.com/reports/gotenberg-rce-cryptomining-107-175-69-137/ --- ## Detection Coverage Summary | Rule Type | Detection | Hunting | MITRE Techniques Covered | Atomics → feed | |---|---|---|---|---| | YARA | 0 | 0 | none (see Coverage Gaps) | 0 | | Sigma | 4 | 3 | T1190, T1059.004, T1036.005, T1543.002, T1140 | 0 | | Suricata | 1 | 3 | T119...

2026-09-06T00:00:00+00:00 2026-09-06T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/sliver-c2-windows-postex-staging-193-233-202-17-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Hunting and detection rules for Sliver C2 Windows post-exploitation staging (193.233.202.17). 4 YARA, 12 Sigma and 2 Suricata rules.

2026-08-18T00:00:00+00:00 2026-08-18T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Hunting and detection rules for a WebLogic deserialization telecom harvester toolkit (13.140.145.210). 8 YARA, 11 Sigma, 12 Suricata rules.

2026-08-03T00:00:00+00:00 2026-08-03T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for the CloudSync assembler toolkit, a five-part intrusion set. Seven YARA, eighteen Sigma and four Suricata rules by component.

2026-07-26T00:00:00+00:00 2026-07-26T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for GOCLOUD two-node cryptojacking operation and orchestrator. Seven YARA, eleven Sigma and five Suricata behavior rules.

2026-07-21T00:00:00+00:00 2026-07-21T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/multivector-ecommerce-rce-toolkit-192-3-1-116-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Hunting and detection rules for the MultiVector ecommerce RCE toolkit operator (192.3.1.116). 5 YARA, 12 Sigma and 13 Suricata rules.

2026-07-17T00:00:00+00:00 2026-07-17T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Hunting and detection rules for a government-targeting exploitation toolkit (144.172.106.236). 6 YARA, 15 Sigma and 8 Suricata rules.

2026-07-03T00:00:00+00:00 2026-07-03T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/kaido-quasar-rat-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for KAIDO, a Quasar RAT fork with hidden desktop browser theft. Three YARA, three Sigma and two Suricata rules included.

2026-07-03T00:00:00+00:00 2026-07-03T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/evilsoul-engine-stealer-maas-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for EvilSoul-Engine stealer-builder kits and panels. Five YARA, six Sigma and one Suricata rule for builder constants.

2026-06-12T00:00:00+00:00 2026-06-12T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/flaskc2-postex-toolkit-67-215-232-25-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for a Flask C2 panel, SQL-CLR backdoor and webshells. Four YARA, six Sigma and three Suricata rules for staged tools.

2026-05-27T00:00:00+00:00 2026-05-27T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/korean-claude-openclaw-221.150.15.104-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for Korean Claude Code OpenClaw operator config abuse (221.150.15.104). Two YARA and four Sigma rules on allowlist behavior.

2026-05-26T00:00:00+00:00 2026-05-26T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/turkish-arpa-openclaw-state-insurer-209.38.205.158-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Hunting and detection rules for the Turkish ARPA state-insurer observability compromise (209.38.205.158). 8 YARA, 11 Sigma, 2 Suricata rules.

2026-05-26T00:00:00+00:00 2026-05-26T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/rovodev-mirai-matrix-c2-87.106.143.220-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Hunting and detection rules for a Rovodev AI-built Mirai variant with Matrix C2. 10 YARA, 10 Sigma and 10 Suricata rules on bots.

2026-05-25T00:00:00+00:00 2026-05-25T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Hunting and detection rules for a Gemini-augmented credential mill with custom Python A2A C2. 8 YARA, 10 Sigma and 2 Suricata rules.

2026-05-25T00:00:00+00:00 2026-05-25T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/ghost-cryptojacker-vova75rus-77.110.96.200-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for GHOST cryptojacker kits by Vova75Rus with rootkit and tunnel parts. Nine YARA, ten Sigma, three Suricata rules.

2026-05-25T00:00:00+00:00 2026-05-25T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for multi-actor AI-agent framework abuse across 8 operators. Eight YARA, fourteen Sigma and eight Suricata rules for broad coverage.

2026-05-17T00:00:00+00:00 2026-05-17T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for CVE-2026-41940 cPanel auth-bypass exploitation and harvester tooling. 1 YARA, 7 Sigma hunting and 2 Suricata rules.

2026-05-16T00:00:00+00:00 2026-05-16T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/inkognito-russian-vpn-phishing-185-221-196-118-20260516-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for Inkognito VPN phishing and brand impersonation sites. Two YARA, one Sigma and two Suricata rules for web assets.

2026-05-16T00:00:00+00:00 2026-05-16T00:00:00+00:00 https://the-hunters-ledger.com/hunting-detections/bellamain-turkish-phaas-79-137-192-3-20260516-detections/ The Hunter's Ledger https://the-hunters-ledger.com

Detection rules for BellaMain Turkish phishing panel and brand kits. Three YARA, five Sigma and one Suricata rule for server-side artifacts.