Detection Rules — Russian Gemini Credential Mill (213.165.51.115)

Campaign: Russian-Gemini-Credential-Mill-UTA-2026-012-213.165.51.115 Date: 2026-05-25 Author: The Hunters Ledger License: CC BY 4.0 Reference: https://the-hunters-ledger.com/reports/russian-gemini-credential-mill-213.165.51.115/

Calibration / Prior-Art Note: Trend Micro (TrendAI Research) published independent coverage of this same operator on 2026-05-22 (“One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign”; operator tracked as “bandcampro”). Cross-identification is DEFINITE via five-point IOC match: @americanpatriotus Telegram channel, 73 stolen Gemini API keys in operator inventory, 20-mutation-per-target generation, Quantum Patriot pipeline branding, and GEMINI.md jailbreak-persistence file. Rules in this file complement the Trend Micro coverage with per-case source-code-derived signatures not previously published. AI Operator Handoff Document novelty MAINTAINED (Trend Micro covers GEMINI.md jailbreak persistence; architecturally distinct from the operator-authored C2_INFRA_TRANSFER.md / DEPLOYED_TOOLS.md / C2_MIGRATION_GUIDE.md structured session-handoff documents). LLM Credential Mutation novelty REFRAMED as first source-code analysis with verbatim prompt reproduction (operational pattern independently confirmed by Trend Micro). Unauthenticated Python-stdlib C2: no prior art found in either publication.

Detection Coverage Summary

This operator runs a custom Python A2A (“agent-to-agent”) C2 stack combined with a Gemini-CLI-augmented credential mill. Coverage below is reorganized by tier: Detection rules are precise/durable enough to alert on; Hunting rules are broader scoping leads that need analyst triage. Rules keyed solely on one of the operator’s rotatable domains (or a third-party service domain being abused) are retired as standalone signatures; those atomics already live in the campaign’s IOC feed.

Detection vs Hunting: Detection rules are high-fidelity and evasion-resilient, safe to alert on. Hunting rules are broader, for scoping and threat-hunting. Expect to review the hits.

Highest-confidence anchors:

• The A2A C2 endpoint set (/api/v1/update, /api/v1/interact, /api/v1/telemetry) plus the operator-bespoke X-Agent-ID header: survives full domain/IP rotation, and anchors both a YARA rule and the Suricata Detection signature.
• The LLM-personalized credential-mutation prompt fragments ("Act as an expert red-team password analyst", "generate exactly 20 likely current mutations") paired with operator-bespoke output filenames (AI_SNIPER_GOODS, AI_ADMIN_MUTANTS): first-publication signature for a novel TTP.

Atomics routed to the IOC feed: tralalarkefe.com (and its c2. / payloads. / windows_server. / gil_dr1. / catchall1. / 10101. subdomains), generativelanguage.googleapis.com, antipublic.one, and the tenant-upcoming-great-descending.trycloudflare.com bootstrap subdomain are transient indicators already carried in russian-gemini-credential-mill-213.165.51.115-iocs.json. No feed edits were required for this backfill (all four domains were already present). 7 of the original file’s rules (3 Sigma, 4 Suricata) each keyed solely on one of these domains with no distinguishing filter surviving its removal; they are retired as standalone signatures below and cross-referenced in Coverage Gaps.

Salvage note: two originally single-object rules were split during tiering to separate a high-confidence, low-FP core from a broader, real-FP-bearing branch that was folded into the same condition:; see the AI Operator Handoff Document Sigma pair and the WordPress credential-mill rate rule (rewritten as a proper Sigma event_count correlation) below.

YARA Rules

Detection Rules

LLM-Personalized Credential Mutator Family

Tier: Detection Robustness: 2 ATT&CK Coverage: T1110.003 (Password Spraying), T1059.006 (Python), T1587 (Develop Capabilities) Confidence: HIGH Rationale: Requires the Gemini API import AND one of three verbatim prompt fragments (the role-priming sentence, the Most Recent Password from dump: field name, or the generate exactly 20 likely current mutations instruction) AND one of four operator-bespoke markers (the output names AI_SNIPER_GOODS and AI_ADMIN_MUTANTS, the target-file name ULTRA_GOLD_TARGETS, or the success-line format [+++ AI SUPER GOOD +++]). The prompt wording and markers are bespoke enough that no legitimate software plausibly combines them with a Gemini API import; the rule fails as soon as any one of its three mandatory groups fails: dropping the google.generativeai reference, rewording all three prompt fragments, or renaming all four markers each evades on its own. Wording fix 2026-10-11: the description used to pair the role-priming prompt with the AI_SNIPER naming, but the role-priming sentence is only one of three alternatives and AI_SNIPER_GOODS only one of four. False Positives: None known: the combination of a Gemini API client reference, one of three bespoke prompt fragments and one of four bespoke output or target markers has negligible legitimate-software overlap. Not goodware-validated. Blind Spots: The three clauses are ANDed, so any one of them failing evades: dropping or renaming the google.generativeai reference, rewording all three prompt fragments (without the role-priming sentence, the Most Recent Password from dump: field and the generate exactly 20 likely current mutations instruction), or renaming all four operator markers; the rule targets Python source in files, not a compiled variant. Validation: Scan ai_sniper_brute.py or a functional equivalent — the three-clause combination must match; a benign script that merely imports google.generativeai (with no role-priming prompt or bespoke output filename) must NOT fire. Deployment: Endpoint AV/EDR file scan, SIEM file-creation alert, git-hook pre-commit scan on CI/CD pipelines, developer workstation endpoint protection.

/*
   Yara Rule Set
   Identifier: Russian Gemini Credential Mill — UTA-2026-012 (Case 1, ai-agent-frameworks-2026-05-23)
   Author: The Hunters Ledger
   Source: https://the-hunters-ledger.com/
   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
*/

rule MAL_Python_LLMPersonalized_Credential_Mutator_Family {
   meta:
      description = "Detects ai_sniper_brute.py-class Python scripts using Gemini API for LLM-personalized per-target password mutation: a google.generativeai reference, one of three verbatim prompt fragments (the role-priming sentence, the Most Recent Password from dump: field or the generate exactly 20 likely current mutations instruction) and one of four operator markers (AI_SNIPER_GOODS, AI_ADMIN_MUTANTS, ULTRA_GOLD_TARGETS or the [+++ AI SUPER GOOD +++] success line), captured from UTA-2026-012 open-directory 213.165.51.115"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/"
      date = "2026-05-25"
      family = "LLM-Personalized-Credential-Mutator"
      campaign = "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
      id = "be090723-71dc-5fb3-955b-c006a4228b56"
   strings:
      $gemini_import  = "google.generativeai" ascii
      $role_prime     = "Act as an expert red-team password analyst" ascii
      $prompt_field1  = "Most Recent Password from dump:" ascii
      $prompt_field2  = "generate exactly 20 likely current mutations" ascii
      $output_sniper  = "AI_SNIPER_GOODS" ascii
      $output_mutants = "AI_ADMIN_MUTANTS" ascii
      $target_file    = "ULTRA_GOLD_TARGETS" ascii
      $success_fmt    = "[+++ AI SUPER GOOD +++]" ascii
   condition:
      filesize < 1MB and
      $gemini_import and
      ($role_prime or $prompt_field1 or $prompt_field2) and
      1 of ($output_sniper, $output_mutants, $target_file, $success_fmt)
}

A2A C2 Server (Unauthenticated Python stdlib)

Tier: Detection Robustness: 3 ATT&CK Coverage: T1071.001 (Web Protocols), T1132.001 (Standard Encoding), T1087 (Account Discovery — /api/v1/agents dumps all beacons) Confidence: HIGH Rationale: The operator’s own banner string (“A2A C2 MULTI-AGENT CONSOLE”), or the combination of BaseHTTPRequestHandler with three of five bespoke /api/v1/ endpoint paths, is essentially a fingerprint of this specific framework — no legitimate web application framework pairs BaseHTTPServer.BaseHTTPRequestHandler with this endpoint set. The decode clause is satisfied by either base64.b64decode or decode('utf-16le'), so UTF-16LE decoding is not required, and the endpoint clause is three of five paths. False Positives: None known. Blind Spots: A rewrite onto a different HTTP framework (Flask/FastAPI) with renamed endpoints and a dropped banner string evades detection. Validation: Scan c2_server.py or a functional equivalent — the banner or endpoint-combination clause, plus a decode string (base64.b64decode alone is enough), must both match; an unrelated BaseHTTPRequestHandler-based Python service with different endpoints must NOT fire. Deployment: Endpoint AV/EDR file scan, server-side file integrity monitoring, threat hunting on Linux server filesystems.

rule MAL_Python_A2A_C2_Server_Unauthenticated {
   meta:
      description = "Detects c2_server.py-class Python stdlib C2 servers (operator-built A2A C2 framework from UTA-2026-012): either the banner A2A C2 MULTI-AGENT CONSOLE, or BaseHTTPRequestHandler with three of the five /api/v1/ endpoint paths (update, agents, interact, telemetry, get_results), together with at least one of the update, agents, interact or telemetry paths, a decode string (base64.b64decode or decode(utf-16le), either one), and PAYLOAD_DIR or BaseHTTPRequestHandler. The sample was unauthenticated, but the rule does not test authentication."
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/"
      date = "2026-05-25"
      family = "A2A-C2-Server-Unauthenticated"
      campaign = "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
      id = "a153389d-4f2f-5432-888b-f920813c333a"
   strings:
      $banner        = "A2A C2 MULTI-AGENT CONSOLE" ascii fullword
      $handler_base  = "BaseHTTPRequestHandler" ascii
      $ep_update     = "/api/v1/update" ascii
      $ep_agents     = "/api/v1/agents" ascii
      $ep_interact   = "/api/v1/interact" ascii
      $ep_telemetry  = "/api/v1/telemetry" ascii
      $ep_results    = "/api/v1/get_results" ascii
      $utf16_decode  = "decode('utf-16le')" ascii
      $b64_decode    = "base64.b64decode" ascii
      $payload_dir   = "PAYLOAD_DIR" ascii
   condition:
      filesize < 500KB and
      ($banner or ($handler_base and 3 of ($ep_update, $ep_agents, $ep_interact, $ep_telemetry, $ep_results))) and
      ($utf16_decode or $b64_decode) and
      1 of ($ep_update, $ep_agents, $ep_interact, $ep_telemetry) and
      ($payload_dir or $handler_base)
}

A2A C2 Client Console / Exec Tool

Tier: Detection Robustness: 2 ATT&CK Coverage: T1071.001 (Web Protocols), T1132.001 (Standard Encoding), T1059.006 (Python) Confidence: HIGH Rationale: The X-Agent-ID bespoke header is required, together with any one of the UTF-16LE encode('utf-16le') call, the /api/v1/interact endpoint or the /api/v1/get_results endpoint, and any one of four corroborating operator-specific markers (the console banner, the HOSTNAME_user agent-ID format, the /api/v1/agents endpoint or time.sleep(2)). Wording fix 2026-10-11: the earlier text said the header, UTF-16LE encoding and get_results polling are all required; the condition accepts any one of the three, and the UTF-16LE call is not required. This header-plus-endpoint pattern is not found in common legitimate Python HTTP client libraries, but it was not goodware-validated. Robustness fix 2026-10-11 (round 2): scored 2, not 3: the mandatory X-Agent-ID string is a renameable header name and the optional pair (the UTF-16LE call and the endpoint names) is generic, so this is a family string combination, not a technique invariant. False Positives: None known; not goodware-validated. The weakest path is the X-Agent-ID header, one of the three client strings and the generic time.sleep(2). Blind Spots: A rewrite that renames the header evades, whatever else it keeps; a rewrite that drops the three client strings (UTF-16LE call and both endpoints) evades. Validation: Scan console.py/exec.py or a functional equivalent — all three clauses must be present to match: the header, one of the UTF-16LE call or the two endpoints, and one corroborating marker (replay is NOT CHECKED); a generic Python HTTP client with a custom header name (but not X-Agent-ID specifically) must NOT fire. Deployment: Endpoint AV/EDR file scan, server-side file integrity monitoring, threat hunting on Linux operator-side hosts.

rule MAL_Python_A2A_C2_Client_Console {
   meta:
      description = "Detects console.py/exec.py-class operator-side C2 client tools of the A2A C2 framework from UTA-2026-012: the X-Agent-ID header (required), any one of the UTF-16LE encode call, /api/v1/interact or /api/v1/get_results, and any one of the banner, the HOSTNAME_user agent-ID format, /api/v1/agents or time.sleep(2)"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/"
      date = "2026-05-25"
      family = "A2A-C2-Client-Console"
      campaign = "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
      id = "a96925a2-ef70-50d3-ab9b-1bd8581523e3"
   strings:
      $agent_id_header   = "X-Agent-ID" ascii fullword
      $encode_utf16le    = "encode('utf-16le')" ascii
      $ep_interact       = "/api/v1/interact" ascii
      $ep_get_results    = "/api/v1/get_results" ascii
      $ep_agents         = "/api/v1/agents" ascii
      $banner            = "A2A C2 MULTI-AGENT CONSOLE" ascii
      $hostname_user_fmt = "HOSTNAME_user" ascii
      $poll_sleep        = "time.sleep(2)" ascii
   condition:
      filesize < 200KB and
      $agent_id_header and
      ($encode_utf16le or $ep_interact or $ep_get_results) and
      1 of ($banner, $hostname_user_fmt, $ep_agents, $poll_sleep)
}

PowerShell WindowsUpdateManager Stealer Loader

Tier: Detection Robustness: 2 ATT&CK Coverage: T1547.001 (Registry Run Keys), T1036 (Masquerading), T1105 (Ingress Tool Transfer), T1059.001 (PowerShell) Confidence: HIGH Rationale: Requires the WindowsUpdateManager masquerade value name AND a corroborating path/key context AND one of four C2-artifact markers (domain, payload-domain, endpoint path, or bespoke header — two of which, the endpoint path and the header, do not depend on the operator’s specific domain) AND a PowerShell networking primitive. Because the C2-artifact clause has non-domain fallback options, the rule still fires after full domain rotation. False Positives: None known — the WindowsUpdateManager string combined with a Run-key text or script-path string and any of the four C2-artifact markers is not a pattern found in any legitimate Windows Update or Windows Defender component. No hive is tested, and the script-path string alone satisfies the Run-key clause. Blind Spots: A rebuild that renames the registry value AND replaces all four C2-artifact markers with something outside this anchor set evades detection. Validation: Scan WindowsUpdateManager.ps1 or a functional equivalent — all four clauses must match; a legitimate PowerShell script using Invoke-RestMethod with no WindowsUpdateManager reference must NOT fire. Deployment: Endpoint AV/EDR file scan and file integrity monitoring on %LOCALAPPDATA%\Microsoft\. Script text recovered from PowerShell script-block logging (Event 4104) can be scanned as a file; the rule does not read events itself.

rule MAL_PowerShell_WindowsUpdateManager_Stealer_Loader {
   meta:
      description = "Detects WindowsUpdateManager.ps1 — operator-bespoke persistence script masquerading as Windows Update component (UTA-2026-012). Requires the WindowsUpdateManager name, the text CurrentVersion\\Run or the path Microsoft\\WindowsUpdateManager.ps1 (no hive is tested), one of four C2 markers (tralalarkefe.com, payloads.tralalarkefe.com, /api/v1/update or X-Agent-ID), and SecurityProtocol or Invoke-RestMethod"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/"
      date = "2026-05-25"
      family = "A2A-C2-PowerShell-Loader"
      campaign = "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
      id = "e7afacdf-0b30-5da9-830f-e8a17a4d7214"
   strings:
      $reg_value       = "WindowsUpdateManager" ascii wide fullword
      $local_path      = "Microsoft\\WindowsUpdateManager.ps1" ascii wide
      $run_key         = "CurrentVersion\\Run" ascii wide
      $c2_domain       = "tralalarkefe.com" ascii wide
      $payload_domain  = "payloads.tralalarkefe.com" ascii wide
      $tls12_set       = "SecurityProtocol" ascii wide
      $invoke_rest     = "Invoke-RestMethod" ascii wide
      $agent_id_hdr    = "X-Agent-ID" ascii wide
      $update_endpoint = "/api/v1/update" ascii wide
   condition:
      filesize < 2MB and
      $reg_value and
      ($local_path or $run_key) and
      1 of ($c2_domain, $payload_domain, $update_endpoint, $agent_id_hdr) and
      ($tls12_set or $invoke_rest)
}

Hunting Rules

C2_INFRA_TRANSFER Explicit AI-to-AI Header Pair (Narrow)

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1587 (Develop Capabilities) ATT&CK Note: The rule tests two header strings and no C2 content, so Web Protocols (T1071.001) is not claimed. Confidence: MODERATE Rationale: The rule tests two literal strings, **To:** Gemini CLI and **From:** Gemini CLI, anywhere in a file under 100 KB, with no line boundary, no Markdown structure and no C2 content. The captured operator handoff carries both, but a legitimate Gemini-to-Gemini build handoff written the same way matches too, and no corpus was measured, so nothing here claims the pair is unique to this operator or first published. Logic fix 2026-10-11: the rule used to carry two more branches, When starting a new session with either header or **Subject:**, and a Cyrillic persona marker with either header or **Subject:**, so a file with neither the pair nor both headers fired; the heading and Blind Spots called the rule narrow and said the session-start directive is covered by the Family rule, so those branches are removed and the condition is the header pair alone. False Positives: A routine handoff note between two Gemini CLI sessions that uses the same bold-markdown To/From convention; any document that quotes both literals. No benign corpus was scanned. Blind Spots: A reformatted handoff document that drops the exact **To:**/**From:** bold-markdown convention evades this narrow rule (the broader Family rule above provides fallback coverage via the session-start directive). Validation: Scan C2_INFRA_TRANSFER.md or a functional equivalent — the header pair must match; unrelated Markdown documentation referencing “Gemini CLI” in prose (not as a To/From header) must NOT fire, while a routine Gemini-to-Gemini handoff using both headers WILL fire (a known positive). Deployment: Endpoint file-creation monitoring, SIEM filesystem alert, threat hunting in ~/.gemini/, ~/.claude/, ~/.codex/ directories on server-class hosts.

rule MAL_Markdown_C2_INFRA_TRANSFER_Pattern {
   meta:
      description = "Hunting rule requiring both the '**To:** Gemini CLI' and '**From:** Gemini CLI' literals from C2_INFRA_TRANSFER.md anywhere in a file under 100 KB (UTA-2026-012); it tests no C2 content and matches any document carrying both"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/"
      date = "2026-05-25"
      family = "AI-Operator-Handoff-Document"
      campaign = "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
      id = "e1a18404-2ded-5aec-93f6-33180c0f5499"
   strings:
      $to_gemini   = "**To:** Gemini CLI" ascii
      $from_gemini = "**From:** Gemini CLI" ascii
   condition:
      filesize < 100KB and
      $to_gemini and $from_gemini
}

AI Operator Handoff Document Family

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1587 (Develop Capabilities), T1071.001 (Web Protocols — C2 endpoint references within the document) Confidence: MODERATE Rationale: Requires a session-priming marker (the To/From Gemini CLI header pair, a session-start load directive, or a knowledge-transfer marker paired with a named handoff-document filename) AND co-occurrence with at least one of four C2 artifact strings: /api/v1/update, /api/v1/interact, the cloudflared access tcp fragment, or the X-Agent-ID header. The co-occurrence requirement narrows the broad “AI-assisted documentation” surface but does not remove it. Tier fix 2026-10-11 (round 2): a project’s own session-start directive plus an ordinary /api/v1/update API guide or a cloudflared access tcp command satisfies the condition with no operator or C2 content, so the rule is Hunting: the matched text is a lead to read, not proof that these generic strings are C2 artifacts. Wording fix 2026-10-11: the description named credential-table patterns, which no string tests, and the second clause is one string, not a C2 endpoint pattern. False Positives: AI-augmented developer documentation (e.g., a project’s own CLAUDE.md) can contain a session-start directive; it would also need one of the four C2 strings, so the co-occurrence suppresses most of that class. Documentation that quotes cloudflared access tcp or X-Agent-ID, or an API guide with a generic /api/v1/update path, alongside a session-start sentence would still match. Not goodware-validated. Blind Spots: A handoff document that omits all four C2-artifact strings (e.g., references C2 infrastructure only by IP, with no /api/v1/ path or bespoke header) evades the second clause. Validation: Scan a captured AI Operator Handoff Document (C2_INFRA_TRANSFER.md, DEPLOYED_TOOLS.md) — both clauses must match (replay is NOT CHECKED); a legitimate CLAUDE.md/AGENTS.md project file with no C2 content must NOT fire, while one holding a session-start directive and an ordinary /api/v1/update API guide WILL fire (a known positive). Deployment: Endpoint file-creation monitoring, filesystem hunt on server-class Linux hosts, git-repo secret-scanning pipeline. Recommended additional scoping: prioritize .md files under ~/.gemini/, ~/.claude/, ~/.codex/ on server-class hosts over developer workstations.

rule MAL_Markdown_AI_Operator_Handoff_Document_Family {
   meta:
      description = "Detects operator-authored AI Operator Handoff Documents — files under 100 KB (no extension or Markdown structure is tested) holding a session-priming marker (the To and From Gemini CLI header pair, a session-start load directive, or KNOWLEDGE TRANSFER: with a named handoff-document filename) and at least one C2 artifact string (/api/v1/update, /api/v1/interact, cloudflared access tcp or X-Agent-ID). The rule has no credential-table test. Three exemplars from UTA-2026-012: C2_MIGRATION_GUIDE.md, C2_INFRA_TRANSFER.md, DEPLOYED_TOOLS.md"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/"
      date = "2026-05-25"
      family = "AI-Operator-Handoff-Document"
      campaign = "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
      id = "5cc8d013-d78a-5b62-982a-b92fc7ff0a55"
   strings:
      $session_directive  = "When starting a new session, refer to this file" ascii nocase
      $knowledge_xfer     = "KNOWLEDGE TRANSFER:" ascii nocase
      $to_gemini_cli      = "**To:** Gemini CLI" ascii
      $from_gemini_cli    = "**From:** Gemini CLI" ascii
      $migration_guide    = "C2_MIGRATION_GUIDE" ascii
      $infra_transfer     = "C2_INFRA_TRANSFER" ascii
      $deployed_tools     = "DEPLOYED_TOOLS" ascii
      $api_v1_update      = "/api/v1/update" ascii
      $api_v1_interact    = "/api/v1/interact" ascii
      $cf_tunnel_pattern  = "cloudflared access tcp" ascii
      $agent_id_format    = "X-Agent-ID" ascii
   condition:
      filesize < 100KB and
      (
         ($to_gemini_cli and $from_gemini_cli) or
         $session_directive or
         ($knowledge_xfer and ($migration_guide or $infra_transfer or $deployed_tools))
      ) and
      1 of ($api_v1_update, $api_v1_interact, $cf_tunnel_pattern, $agent_id_format)
}

Russian Operator Persona Strings

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1587 (Develop Capabilities — operator infrastructure docs) Confidence: MODERATE Rationale: Requires one of three Cyrillic persona strings (informal address terms for Gemini, a victim-machine nickname, or a session-start idiom) AND one of five operational markers. Two of the five operational markers (/api/v1/ and the bare AIzaSy key prefix) are individually generic — they appear across many unrelated APIs and any project with a legitimate Gemini key — so the composite condition carries real, analyst-triage-worthy FP risk rather than alerting-grade precision. Framed by design as a forensic/attribution aid, not a production detection. False Positives: Standalone, the Cyrillic persona strings appear in ordinary Russian-language content; combined with the generic /api/v1/ path fragment or a bare AIzaSy key prefix (present in any legitimate Gemini-integrated codebase authored in Russian), the composite condition can still produce non-operator hits. Deployment: Threat hunting on server-class Linux hosts, forensic investigation of seized operator infrastructure, post-incident artifact analysis. Deploy only with the full composite condition — never on the persona strings alone.

rule MAL_Russian_Operator_Persona_Strings {
   meta:
      description = "Detects UTA-2026-012 operator-authored files via Cyrillic persona strings (Братух addressing of Gemini, Комп Доктора victim-machine reference, Погнали session-start idiom) co-occurring with C2 endpoint or API key indicators — an attribution aid for post-incident forensics; two of the five operational markers are generic, so triage every hit"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/"
      date = "2026-05-25"
      family = "A2A-C2-Operator-Attribution"
      campaign = "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
      id = "cc850da5-6d7d-51f3-8d01-7c5024b30ba1"
   strings:
      /* Cyrillic persona strings — UTF-8 encoded */
      $bro_bratukh     = "\xd0\x91\xd1\x80\xd0\xb0\xd1\x82\xd1\x83\xd1\x85" /* "Братух" */
      $comp_doktora    = "\xd0\x9a\xd0\xbe\xd0\xbc\xd0\xbf \xd0\x94\xd0\xbe\xd0\xba\xd1\x82\xd0\xbe\xd1\x80\xd0\xb0" /* "Комп Доктора" */
      $pognali         = "\xd0\x9f\xd0\xbe\xd0\xb3\xd0\xbd\xd0\xb0\xd0\xbb\xd0\xb8" /* "Погнали" */
      $quantum_patriot = "quantum_patriot" ascii
      $gemini_api_key  = "AIzaSy" ascii
      $api_endpoint    = "/api/v1/" ascii
      $cf_tunnel       = "tralalarkefe.com" ascii
      $sniper_goods    = "AI_SNIPER_GOODS" ascii
   condition:
      filesize < 5MB and
      1 of ($bro_bratukh, $comp_doktora, $pognali) and
      1 of ($gemini_api_key, $api_endpoint, $cf_tunnel, $sniper_goods, $quantum_patriot)
}

Stolen LLM API Key Validator

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1078 (Valid Accounts — stolen API keys), T1059.006 (Python), T1552.001 (Unsecured Credentials in Files) Confidence: MODERATE Rationale: Logic fix 2026-10-10: the key test was the literal text AIzaSy[0-9a-zA-Z_-] (brackets included), which is regex source text and cannot match an actual AIzaSy key, although the description says the script holds the keys in a block string. The rule now accepts either that literal pattern text (a script that carries the key-prefix regex) or at least 3 actual key shapes (AIzaSy followed by 33 key characters). The captured check_keys.py was not re-scanned in this pass, so it is not confirmed which form it contains. Requires the AIzaSy key-prefix pattern text or at least 3 key shapes AND a bulk-storage or search marker (raw_keys/re.findall) AND a validation-pipeline marker (the models endpoint, a valid-keys output, or a retest marker), with a 2-of-N reinforcement across all seven anchors. A single-key SDK usage does not satisfy the key-shape branch; the claim in earlier versions that every bulk-key validator is malicious tooling is withdrawn, since a legitimate key-rotation or key-audit script has the same shape. False Positives: A legitimate developer script that validates API keys. Round 2, 2026-10-10: with a single key-shaped string, a raw_keys marker and the models endpoint, the previous round’s condition fired on a synthetic benign single-key validator, so the claim that every such script is malicious was not supported and the rule was re-tiered from Detection to Hunting. The key-shape branch now needs at least 3 key-shaped strings (the documented inventory holds 40+ keys); the AIzaSy[0-9a-zA-Z_-] pattern-text branch is unchanged and still fires on any script that carries that regex source plus a bulk-storage or search marker and a validation-pipeline marker, which includes a benign key-checking script. A script holding 40+ Gemini API keys in a block string with a validation loop against Google’s models endpoint, which is the documented tool, is not a legitimate development pattern. Blind Spots: A rewrite that stores keys in a different structure (e.g., one per line in an external file, loaded without the raw_keys/findall marker in-code) evades the second clause. Validation: Scan check_keys.py or a functional equivalent — all four condition clauses must be satisfied. A single-key SDK integration with one key-shaped string does not satisfy the key clause; a benign script that carries the AIzaSy[0-9a-zA-Z_-] pattern text with the other markers does fire and is separated from the operator’s tool by reading what it validates. Deployment: Endpoint AV/EDR file scan, SIEM file-creation monitoring, developer workstation endpoint protection, CI/CD secret scanning.

rule MAL_Python_Stolen_LLM_Key_Validator {
   meta:
      description = "Detects check_keys.py-class Python scripts: bulk Gemini API key inventory (AIzaSy-prefixed keys in block string) validated against generativelanguage.googleapis.com/v1beta/models — stolen-key validation pipeline from UTA-2026-012"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/"
      date = "2026-05-25"
      modified = "2026-10-10"
      family = "Stolen-LLM-Key-Validator"
      campaign = "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
      id = "37ec0969-e2c8-5e91-b5a1-40d75c43d590"
   strings:
      $key_prefix_re    = "AIzaSy[0-9a-zA-Z_-]" ascii
      $key_shape        = /AIzaSy[0-9A-Za-z_-]{33}/ ascii
      $raw_keys_block   = "raw_keys" ascii fullword
      $validation_ep    = "generativelanguage.googleapis.com/v1beta/models" ascii
      $findall_pattern  = "re.findall" ascii
      $valid_keys_out   = "valid_gemini_keys" ascii
      $openai_key       = "sk-proj-" ascii
      $venice_key       = "VENICE_ADMIN_KEY" ascii
      $retest_pattern   = "retest_keys" ascii
   condition:
      filesize < 500KB and
      ($key_prefix_re or #key_shape >= 3) and
      ($raw_keys_block or $findall_pattern) and
      ($validation_ep or $valid_keys_out or $retest_pattern) and
      2 of ($key_prefix_re, $key_shape, $raw_keys_block, $validation_ep, $valid_keys_out, $openai_key, $venice_key, $retest_pattern)
}

Sigma Rules

Detection Rules

1Password Vault Export File Written by a Non-1Password Process

Tier: Detection Robustness: 2 ATT&CK Coverage: T1555.005 (Credentials from Password Stores — Password Managers), T1005 (Data from Local System) Confidence: HIGH Rationale: Requires a 1Password vault-export file extension/name pattern AND a filter excluding the legitimate 1Password application images. This combination — export artifact plus a non-1Password writing process — is a durable technique signal independent of any campaign-specific domain or filename. False Positives: Legitimate authorized 1Password vault migration or backup workflows by IT staff; the 1Password CLI (op.exe) used for authorized scripted access is not excluded by the current filter and should be allowlisted per-deployment. Blind Spots: A theft routine that renames the exported file before it touches disk (avoiding the .1pux/.1pif/1Password Export pattern) evades detection. Validation: Trigger a 1Password vault export from a non-1Password process (e.g., a Python script writing or copying an export file) — must match; a export created and immediately handled by 1Password.exe itself must NOT fire. Deployment: Endpoint EDR / Sysmon-fed SIEM (file-creation telemetry).

title: 1Password Vault Export File Written by a Non-1Password Process
id: 0ced06f4-f028-44fa-b7fc-4f1a96c3076d
status: experimental
description: >-
  Detects a file event that creates or writes a 1Password vault export file (a name ending
  .1pux, .1pif or 1Password Export) from a process other than the 1Password application.
  A file event records creation or write, never a read, so access is not covered. The UTA-2026-012 operator's credential ledger
  (CREDENTIALS.md) references a complete 1Password vault export dated 2026-03-20 from an
  unidentified victim, indicating successful extraction of a victim's entire password manager
  vault via stolen access. The writing process being anything other than the 1Password application
  images is the discrimination signal; Python or PowerShell are the cases of interest.
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
tags:
    - attack.credential-access
    - attack.t1555.005
    - attack.collection
    - attack.t1005
    - detection.emerging-threats
    - stp.3
logsource:
    category: file_event
    product: windows
detection:
    selection_vault_files:
        TargetFilename|endswith:
            - '.1pux'
            - '.1pif'
            - '1Password Export'
    filter_legitimate_1password:
        Image|endswith:
            - '\1Password.exe'
            - '\1Password 7.exe'
            - '\1Password 8.exe'
    condition: selection_vault_files and not filter_legitimate_1password
falsepositives:
    - Legitimate authorized 1Password vault migration or backup workflows by IT staff
    - 1Password CLI (op.exe) used for authorized scripted access — allowlist op.exe Image path
level: high

AI Operator Handoff Document Bespoke Filename Created on Server Filesystem

Tier: Detection Robustness: 2 ATT&CK Coverage: T1587 (Develop Capabilities) Confidence: HIGH Rationale: Salvage-split from the original combined rule: the original condition: selection_specific_names or selection_gemini_dir_context OR’d this bespoke-filename branch together with a broader ~/.gemini/ + generic-tooling-filename branch that includes GEMINI.md/SKILL.md (the standard legitimate Gemini CLI config filenames). Splitting isolates the two bespoke, no-known-legitimate-collision filenames (C2_MIGRATION_GUIDE.md, C2_INFRA_TRANSFER.md) into a Detection-grade rule; the broader/generic branch is now its own Hunting rule below. False Positives: None known — these specific filenames are not used by any known legitimate software. Blind Spots: A rebuild that renames both exemplar filenames evades detection. Fallback coverage for the ~/.gemini/ directory context is provided by the Executable Script or Skill File Created in Gemini CLI Config Directory rule (dca5d3c0), not by the handoff-filename Hunting rule below: as of 2026-09-07 that rule’s SKILL.md and GEMINI.md arms were removed as duplicates, so dca5d3c0 is now the only directory-context fallback. Validation: Create a file named C2_INFRA_TRANSFER.md or C2_MIGRATION_GUIDE.md anywhere on a monitored filesystem — must match; creation of an unrelated Markdown file must NOT fire. Deployment: File integrity monitoring, Sysmon Event ID 11, EDR file-creation telemetry.

title: AI Operator Handoff Document Bespoke Filename Created on Server Filesystem
id: 0532e874-0106-4db7-9fc7-2e44939eae23
status: experimental
description: >-
  Detects file creation events matching the UTA-2026-012 operator's two confirmed
  bespoke AI Operator Handoff Document filenames: C2_MIGRATION_GUIDE.md (Russian-language
  C2 redeployment guide for new Gemini CLI sessions) and C2_INFRA_TRANSFER.md (explicit
  To/From Gemini CLI header — AI-to-AI knowledge transfer). Neither filename has a known
  legitimate-software use. Split from the original combined rule during tiering to isolate
  this no-known-collision branch from the broader ~/.gemini/ directory-context branch,
  which includes the standard legitimate Gemini CLI config filenames GEMINI.md/SKILL.md
  and carries meaningfully higher false-positive risk (see the companion Hunting rule).
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
tags:
    - attack.resource-development
    - attack.t1587
    - detection.emerging-threats
    - stp.3
logsource:
    category: file_event
    product: linux
detection:
    selection_specific_names:
        TargetFilename|endswith:
            - '/C2_MIGRATION_GUIDE.md'
            - '/C2_INFRA_TRANSFER.md'
    condition: selection_specific_names
falsepositives:
    - Unlikely — C2_MIGRATION_GUIDE.md and C2_INFRA_TRANSFER.md have no known legitimate use; investigate any match
level: high

Mass WordPress wp-login.php Credential Validation Rate Exceeded (Correlation)

Tier: Detection (correlation) / base selection below is Hunting — non-alerting, tallied separately Robustness: 2 ATT&CK Coverage: T1110.003 (Password Spraying), T1059.006 (Python) Confidence: HIGH Rationale: Salvage-rewrite from a bare selection to a proper Sigma event_count correlation. The original rule’s detection: block matched any single POST to /wp-login.php with no aggregation — as written it fires on ordinary, ubiquitous WordPress login traffic, since a single request to this endpoint is not itself anomalous (the original text acknowledged this in prose but never encoded the threshold). This entry contains two Sigma objects, tallied separately, co-located in one block per correlation-rule convention: the base selection (below, tier Hunting on its own — non-alerting, informational, exists only to feed the correlation) and the correlation itself (tier Detection — the actual alert). The correlation encodes the operator’s real signature: 500+ requests to /wp-login.php from one source within 60 seconds, derived from the operator’s 3-worker ThreadPoolExecutor pipeline against 30,000+ target sites. Volume-based, so it survives target-list and infrastructure rotation entirely. False Positives: Authorized load-testing or offensive-security assessments against WordPress installations at or above the threshold; tune the count threshold upward for environments with known legitimate load-testing activity. Blind Spots: An operator who throttles below the 500/60s threshold (e.g., reduces worker count) evades the correlation; the c-ip group-by field name assumes a W3C-extended-format webserver log — adjust the field name to match your log source’s actual client-IP field. Validation: Replay 500+ POSTs to /wp-login.php from one source within 60 seconds — the correlation must fire; fewer than 500 requests, or the same volume spread across many source IPs, must NOT fire. Deployment: Web Application Firewall, reverse proxy access logs, Zeek http.log, SIEM with Sigma correlation-rule support.

title: WordPress wp-login.php POST Request (Correlation Base)
id: c6ff58ec-caa8-43e8-a73d-7869abcae0eb
status: experimental
description: >-
  Base selection for the Mass WordPress Credential Validation Rate correlation rule below.
  Matches individual HTTP POST requests to /wp-login.php — not alerting-grade on its own
  (a single login POST is ordinary WordPress traffic); tier Hunting/informational, serves
  only as the correlation's input event.
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
tags:
    - attack.credential-access
    - attack.t1110.003
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|contains: '/wp-login.php'
        cs-method: 'POST'
    condition: selection
falsepositives:
    - Any single legitimate login attempt to a WordPress site — not anomalous in isolation; see the correlation rule for the rate-based signal
level: informational
---
title: Mass WordPress wp-login.php Credential Validation Rate Exceeded — Possible A2A Credential Mill
id: a3f5c8e2-6b4d-4a91-8f2e-5d7c9b1a4e63
status: experimental
description: >-
  Fires when the base wp-login.php POST selection exceeds 500 events from a single source IP
  within a 60-second window — the mass-credential-validation signature of mass_wp_mutator.py
  and the operator's nuclei wp_admin_hunter.yaml template for UTA-2026-012 credential
  validation at scale (driven by a ThreadPoolExecutor 3-worker pipeline against target lists
  of 30,000+ WordPress sites). Replaces the original non-aggregating selection, which fired
  on any single POST and had no meaningful precision without this threshold.
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
tags:
    - attack.credential-access
    - attack.t1110.003
    - detection.emerging-threats
correlation:
    type: event_count
    rules:
        - c6ff58ec-caa8-43e8-a73d-7869abcae0eb
    group-by:
        - c-ip
    timespan: 60s
    condition:
        gte: 500
falsepositives:
    - Authorized load-testing or authorized offensive-security assessments against WordPress installations at or above the threshold
    - WordPress security scanner tools (WPScan, Jetpack Protect) — these generally use lower rates than 500/60s
level: high

Hunting Rules

Tally note: this subsection has 5 physical entries. A 6th Hunting-tallied object, the wp-login.php POST correlation base selection (id c6ff58ec-caa8-43e8-a73d-7869abcae0eb), is co-located with its correlation rule under Detection Rules above, per the correlation co-location convention, rather than duplicated here.

Executable Script or Skill File Created in Gemini CLI Config Directory

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1587 (Develop Capabilities), T1059.006 (Python) Confidence: MODERATE Rationale: The ~/.gemini/ directory paired with executable content is a genuine operator-side installation signal, but the original rule had no exclusions at all, so it matched the Gemini CLI’s own vendor-managed skill and plugin trees. Revised 2026-09-07 after measurement against live telemetry: of 19 matching events over 14 days, 18 were vendor software writing vendor filenames into vendor directories, and the *SKILL.md arm alone carried 14 of the 19. The *GEMINI.md and *.ps1 arms matched nothing. The fix excludes the vendor trees (/.gemini/*/builtin/, /.gemini/*/plugins/, /.gemini/extensions/) rather than removing the filename arms, so operator-authored SKILL.md and GEMINI.md outside those trees still match. Measured effect: 19 to 1 over the same window. The rule was also renamed. Its previous title asserted “on Server Host”, which the selection logic never implemented, and a subscriber scanning a rule list reads the title. False Positives: Operator-authored hook scripts under the CLI’s own hook directory, which is a supported feature. Allowlist the specific hook filenames in use. Also a filesystem-level copy, migration or restore of a home directory, which replays every path in the copied tree through file-creation telemetry, including a backup target such as /mnt/.../@home/user/.gemini/.... Tested and rejected (do not re-argue these): Scoping to /root/.gemini/* as a proxy for server-class hosts takes the rule from 19 matches to 0, and was rejected because it misses any operator running as a non-root user, which is the default on most modern VPS images. The hypothesis that periodic btrfs snapshots drive this was refuted on mechanism: a btrfs snapshot is a copy-on-write metadata operation producing one subvolume directory entry, not one event per file. The 119 .gemini/ events attributed to /usr/bin/btrfs were a single one-day bulk copy during a 2026-08-28 drive migration, with zero on the other 89 days of a 90-day window. Deployment: Sysmon (Linux), auditd, file-integrity monitoring. There is no portable host-class field in Sigma or in ECS, so server-vs-workstation scoping remains a deployment decision made by asset group or IP range, and is deliberately no longer claimed in the title.

title: Executable Script or Skill File Created in Gemini CLI Config Directory
id: dca5d3c0-5b22-453e-a36f-7696d927a739
status: experimental
description: >-
  Detects creation of executable scripts (.sh, .py, .ps1) or agent-priming documents
  (GEMINI.md, SKILL.md) inside a Gemini CLI configuration directory, excluding the
  vendor-managed skill and plugin trees the tool populates itself. The UTA-2026-012
  operator stores C2 management skills (~/.gemini/skills/cf-c2-manager/SKILL.md), session
  handoff documents (~/.gemini/GEMINI.md), and Gemini CLI session JSONs
  (~/.gemini/tmp/root/chats/) on the C2 server itself. Operator-authored content lands
  outside the vendor trees, which is what this rule keys on.
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
modified: '2026-09-07'
tags:
    - attack.resource-development
    - attack.t1587
    - attack.execution
    - attack.t1059.006
    - detection.emerging-threats
logsource:
    category: file_event
    product: linux
    definition: >-
      Requires file-creation telemetry on Linux carrying the full target path, such as
      Elastic Defend file events, auditd watches on the user home, or Sysmon for Linux
      FileCreate. Paths are matched verbatim, so a bulk filesystem copy or restore that
      replays a home directory will produce matches for the copied tree.
detection:
    selection_gemini_dir:
        TargetFilename|contains: '/.gemini/'
    selection_executable:
        TargetFilename|endswith:
            - '.sh'
            - '.py'
            - '.ps1'
            - 'GEMINI.md'
            - 'SKILL.md'
    filter_vendor_trees:
        TargetFilename|contains:
            - '/.gemini/*/builtin/'
            - '/.gemini/*/plugins/'
            - '/.gemini/extensions/'
    condition: selection_gemini_dir and selection_executable and not filter_vendor_trees
falsepositives:
    - >-
      Operator-authored hook scripts under the CLI's own hook directory, which is a
      supported feature; allowlist the specific hook filenames in use
    - >-
      A filesystem-level copy, migration or restore of a home directory, which replays
      every path in the copied tree through file-creation telemetry
level: medium

Cloudflared Access TCP Tunnel to Potentially Unauthorized Hostname

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1090.004 (Domain Fronting), T1572 (Protocol Tunneling), T1021.001 (RDP via tunnel), T1021.004 (SSH via tunnel) Confidence: MODERATE Rationale: Anchored on the technique (cloudflared access tcp --hostname, the command form the operator used; the rule tests access, tcp and --hostname as three unordered substrings) rather than any specific domain, so it survives full rotation of the operator’s infrastructure — but it requires an organization-specific allowlist to be populated before deployment, and ships with only a placeholder value. False Positives: Organizations with legitimate Cloudflare Tunnel deployments using the access tcp command form (as opposed to the more common tunnel run service registration); developer workstations running cloudflared for legitimate service exposure. Deployment: Sysmon for Linux or EDR process-creation events that supply Image and CommandLine, on server-class hosts. Raw auditd EXECVE records carry neither field in normalised form and would need normalising first; this page declares no such normalisation. Populate filter_known_legit with your organization’s known Cloudflare Tunnel hostnames before deployment.

title: Cloudflared Access TCP Tunnel to Potentially Unauthorized Hostname
id: 57ce00ce-d1ee-4621-9654-cefb4bf3b60d
status: experimental
description: >-
  Detects Linux process creation of cloudflared whose command line contains access, tcp and
  --hostname (three substrings, in any order), unless it also contains the allowlist hostname.
  The shipped allowlist holds only a placeholder, so until a deployment adds its known
  hostnames every such invocation fires, and no host role is tested. The UTA-2026-012 operator used cloudflared access tcp
  --hostname windows_server.tralalarkefe.com and --hostname gil_dr1.tralalarkefe.com to
  maintain persistent reverse-TCP tunnels to the victim machines for RDP and SSH.
  This pattern allows persistent victim access without victim-side firewall rule changes.
  Tune by adding your organization's known legitimate Cloudflare Tunnel hostnames to the
  allowlist filter below.
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
tags:
    - attack.command-and-control
    - attack.t1090.004
    - attack.t1572
    - attack.lateral-movement
    - attack.t1021.001
    - attack.t1021.004
    - detection.emerging-threats
logsource:
    category: process_creation
    product: linux
    definition: 'Requires Linux process-creation events with Image and CommandLine populated, for example Sysmon for Linux EID 1 or an EDR process feed. Raw auditd EXECVE records need normalising first.'
detection:
    selection:
        Image|endswith: '/cloudflared'
        CommandLine|contains|all:
            - 'access'
            - 'tcp'
            - '--hostname'
    filter_known_legit:
        CommandLine|contains: 'your-org-tunnel.example.com'  # REPLACE with org's known CF Tunnel hostnames
    condition: selection and not filter_known_legit
falsepositives:
    - Legitimate organizational Cloudflare Tunnel deployments — populate the allowlist filter with known tunnel hostnames
    - Developer workstations running cloudflared for legitimate service exposure
level: medium

WindowsUpdateManager PowerShell Beacon Registry Run Key Persistence

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1547.001 (Registry Run Keys), T1036 (Masquerading) Confidence: MODERATE Rationale: Keyed on two operator-chosen literals, the WindowsUpdateManager masquerade value name and the WindowsUpdateManager.ps1 file name in the value data, with no combinatorial fallback in the Sigma logic itself (unlike the YARA loader rule, which pairs this same value name with an additional C2-artifact clause). A rebuild that renames either one fully evades. Today’s false-positive rate is low (no legitimate Windows component uses this exact value name), but durability, not current precision, caps the tier here — level recalibrated from the original high to medium to match the Hunting tier per the level-discipline gate, since the rule does not survive a rename. Logic fix 2026-10-11: the title and description say the Run value points to the PowerShell script and is a per-user key, but the selection was the value-name substring alone, so a machine-wide HKLM value of that name matched and no PowerShell script was tested; the rule now also requires the HKU\ hive prefix and WindowsUpdateManager.ps1 in Details. Boundary fix 2026-10-11 (round 2): the value-name test was contains, so a value named WindowsUpdateManagerBackup matched; it is now endswith, which makes the value name exact. A hit is a configured Run value that names the script; it is not proof that the unextracted beacon ran. False Positives: None known today — WindowsUpdateManager is not a legitimate Windows Update component registry value; risk is entirely in the rule going stale after a rebuild, not in false alarms against current builds. A machine-wide (HKLM) value of the same name no longer matches. Deployment: Sysmon Event ID 13 (registry value set) and EDR registry monitoring that reports TargetObject and Details. Windows Event ID 4657 carries ObjectName and NewValue instead and would need a field mapping this rule does not declare, so it is not a deployment source as written. Pair with the YARA PowerShell-loader rule (which requires a corroborating C2-artifact clause) for higher-confidence composite alerting.

title: WindowsUpdateManager PowerShell Beacon Registry Run Key Persistence
id: 833c2659-c255-4e42-a6b8-2cfd8b0b8ac1
status: experimental
description: >-
  Detects a registry write to the per-user (HKU\<SID>, shown as HKCU in the report)
  Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateManager value whose data
  contains WindowsUpdateManager.ps1 (the report records it pointing to
  %LOCALAPPDATA%\Microsoft\WindowsUpdateManager.ps1) — the operator-bespoke
  victim-side persistence mechanism for the UTA-2026-012 PowerShell C2 beacon documented
  in C2_INFRA_TRANSFER.md. The report names no legitimate Windows Update component that
  creates this HKCU Run value.
  The WindowsUpdateManager value name is the operator's deliberate masquerade of Windows Update,
  but is a single renameable literal with no fallback anchor in this selection — a rebuild
  that renames the value evades detection entirely, so this is scoped as a Hunting signal
  rather than a Detection one despite today's low false-positive rate.
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1547.001
    - attack.stealth
    - attack.t1036
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection_value_name:
        TargetObject|endswith: '\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateManager'
    selection_hive:
        TargetObject|startswith: 'HKU\'
    selection_script:
        Details|contains: 'WindowsUpdateManager.ps1'
    condition: selection_value_name and selection_hive and selection_script
falsepositives:
    - Unlikely today — WindowsUpdateManager is not a legitimate Windows Update component registry value; a future rebuild renaming this value would evade rather than false-positive
level: medium

Python Process With c2_server or BaseHTTPServer in the Command Line (A2A C2 Server Pattern)

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1071.001 (Web Protocols), T1132.001 (Standard Encoding), T1059.006 (Python) Confidence: MODERATE Rationale: Keyed on the c2_server/BaseHTTPServer command-line substring, a script-naming/library-usage literal that a rebuild can trivially rename or replace. Retained as a hunting query, not a production alert, per the original assessment. Wording fix 2026-10-11: the earlier title and description promised a non-standard port and UTF-16LE encoding; the selection is a Python image path plus either token, with no port or encoding test. False Positives: Legitimate Python web services on non-standard ports (Django dev server, Flask, etc.); security testing frameworks (Impacket, Responder) using similar port patterns. Blind Spots: Versioned interpreter paths (python3.11) and a script started through another launcher evade; the two command-line tokens are the only anchor. Deployment: EDR process-creation telemetry, auditd execve, threat hunting. Combine with the network-layer Suricata signature for higher-fidelity composite alerting.

title: Python Process With c2_server or BaseHTTPServer in the Command Line (A2A C2 Server Pattern)
id: 253e1a6a-f4f3-4227-9106-94e9fdb4f949
status: experimental
description: >-
  Detects a process whose image path ends /python3 or /python and whose command line contains
  c2_server or BaseHTTPServer — the runtime form of the UTA-2026-012 operator's c2_server.py
  BaseHTTPServer deployment. The report records the operator's multi-instance deployment on ports
  8081, 8090 and 10101 (from c2_server.log file names) and a UTF-16LE body encoding for PowerShell
  beacon commands, but the rule tests neither a port nor an encoding: either command-line token
  alone fires. Versioned interpreter paths such as /usr/bin/python3.11 do not end /python3 and
  do not match.
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1132.001
    - attack.execution
    - attack.t1059.006
    - detection.emerging-threats
logsource:
    category: process_creation
    product: linux
detection:
    selection_python:
        Image|endswith:
            - '/python3'
            - '/python'
    selection_c2_server:
        CommandLine|contains:
            - 'c2_server'
            - 'BaseHTTPServer'
    condition: selection_python and selection_c2_server
falsepositives:
    - Legitimate Python web services on non-standard ports (Django dev server, Flask, etc.) — tune by excluding known-legitimate service paths and process owners
    - Security testing frameworks (Impacket, Responder) that use similar port patterns
level: low

AI Operator Handoff Filename Created in Gemini CLI Config Directory

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1587 (Develop Capabilities) Confidence: MODERATE Rationale: Salvage-split from the original combined rule (companion to the Detection-tier bespoke-filename rule above), isolating the operator’s AI Operator Handoff Document naming convention inside the ~/.gemini/ directory context. Revised 2026-09-07 after measurement against live telemetry, which found the rule was producing no unique detections at all. Its SKILL.md and GEMINI.md arms were byte-identical to the same two arms in the companion dca5d3c0 rule, so every event matching them fired both rules: over 14 days this rule matched 14 events, the intersection with dca5d3c0 was also 14 of 14, and its two unique arms (DEPLOYED_TOOLS.md, CLOUDFLARE_INFRA.md) matched nothing. Both vendor filename arms were therefore removed. Measured effect: 14 to 0 over the same window, at zero coverage cost, because operator-authored SKILL.md and GEMINI.md remain covered by dca5d3c0, which keeps both filenames and excludes only the vendor trees. The rule was also renamed: its previous title asserted “on Server Host”, which the selection logic never implemented. False Positives: A project genuinely tracking deployed tooling or Cloudflare infrastructure notes under the agent config directory. Confirm the file content and author. The SKILL.md and GEMINI.md collision with legitimate Gemini CLI installations no longer applies, because those arms are gone. Salvage-split lesson (worth keeping): the original split moved the bespoke filenames into a Detection rule but left the broad arm duplicated in both halves rather than moved into one. That doubles alert volume per event while coverage stays flat, and it inflates every downstream false-positive count by exactly the duplication. Check for arm overlap whenever a rule is split. Deployment: File integrity monitoring, Sysmon Event ID 11, EDR file-creation telemetry. There is no portable host-class field in Sigma or in ECS, so server-vs-workstation scoping is a deployment decision and is deliberately no longer claimed in the title.

title: AI Operator Handoff Filename Created in Gemini CLI Config Directory
id: b7d2e4f1-9a3c-4e58-b1d6-3f8a2c5e9d74
status: experimental
description: >-
  Detects file creation matching the UTA-2026-012 operator's AI Operator Handoff Document
  naming convention inside a Gemini CLI configuration directory: DEPLOYED_TOOLS.md (a
  start-of-session load directive) and CLOUDFLARE_INFRA.md. The SKILL.md and GEMINI.md
  arms were removed on 2026-09-07 because they are the tool's own standard filenames and
  were byte-identical to the same arms in the companion executable-content rule, so they
  produced duplicate alerts and no unique detections. Operator-authored SKILL.md and
  GEMINI.md remain covered by that companion rule, which excludes the vendor trees.
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
modified: '2026-09-07'
tags:
    - attack.resource-development
    - attack.t1587
    - detection.emerging-threats
logsource:
    category: file_event
    product: linux
    definition: >-
      Requires file-creation telemetry on Linux carrying the full target path, such as
      Elastic Defend file events, auditd watches on the user home, or Sysmon for Linux
      FileCreate.
detection:
    selection_gemini_dir_context:
        TargetFilename|contains: '/.gemini/'
        TargetFilename|endswith:
            - 'DEPLOYED_TOOLS.md'
            - 'CLOUDFLARE_INFRA.md'
    condition: selection_gemini_dir_context
falsepositives:
    - >-
      A project genuinely tracking deployed tooling or Cloudflare infrastructure notes
      under the agent config directory; confirm the file content and author
level: medium

LSASS Process Access With a Credential-Dumping GrantedAccess Mask and No Source Process Filter

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1003.001 (LSASS Memory) ATT&CK Note: Security Account Manager (T1003.002) is withdrawn: the report records local SAM hashes in the operator’s ledger, not an LSASS process-access event, and this rule tests LSASS access only. Confidence: MODERATE Rationale: Retitled during tiering: the original title (“NTLM Hash Dump Followed by Cloudflare Tunnel Exfiltration Within 10 Minutes”) described a two-stage correlation, but the YAML logic below only ever implemented the first stage (LSASS process-access with credential-dumping-associated GrantedAccess masks); the Cloudflare Tunnel egress half was never encoded and would require a separate SIEM temporal join (see Coverage Gaps). The GrantedAccess-mask pattern itself is a well-established LSASS-credential-access signature independent of this campaign’s specific infrastructure. Round 2 fix 2026-10-11: the description no longer calls this the first stage of an observed sequence and the SAM technique (T1003.002) is not claimed, because the report records captured SAM hashes and no LSASS access event. Tier, level and boundary fix 2026-10-11: the rule ships no source-process filter, and its own false-positive list names AV/EDR sensors and domain controller synchronization as expected hits, so it cannot alert unattended and moves from Detection to Hunting, with level from high to medium. The Validation line used to promise that a trusted sensor does not fire because of an Image filter, but no filter exists. The mask test was a substring (|contains), which also matched longer values that start with these digits; it is now an exact match on each of the three masks. False Positives: Legitimate AV/EDR processes accessing lsass.exe for telemetry (no source-process filter ships with the rule, so these match until the deployer excludes them by SourceImage); domain controller synchronization operations. Blind Spots: Captures only the LSASS-access stage; does not by itself confirm exfiltration occurred. Credential-dumping tools that request a narrower access mask than the three listed evade this rule. Validation: Run a credential-dumping tool against lsass.exe: if it requests one of the three listed masks the rule must fire. A security sensor that opens lsass.exe with one of those masks also fires, since the rule has no source-process filter; exclude your deployed sensors by SourceImage before using it for anything beyond hunting. Deployment: EDR correlation rules, SIEM temporal correlation queries, Sysmon Event ID 10 (lsass access) + network log correlation (pair with DNS/network monitoring for *.trycloudflare.com / *.tralalarkefe.com egress within a 10-minute window for the full two-stage signal — see Coverage Gaps).

title: LSASS Process Access With a Credential-Dumping GrantedAccess Mask and No Source Process Filter
id: f4e6c9ce-7511-4e5e-9e52-adba3f0ae030
status: experimental
description: >-
  Detects a process-access event whose target is lsass.exe and whose GrantedAccess is exactly
  0x1010, 0x1410 or 0x1fffff, masks associated with credential-dumping tooling. The rule has no
  source-process filter, so security agents and other software that open lsass.exe with these
  masks match too. The report records plaintext local SAM NTLM hashes from two
  internal subnets in the UTA-2026-012 operator's credential ledger for the healthcare victim,
  but it records no LSASS process-access event for that compromise, so whether this access
  occurred there is NOT CHECKED. The rule tests only LSASS access; a follow-on Cloudflare Tunnel
  egress would need a separate SIEM temporal join (not expressible in a single
  non-correlation Sigma selection) — see the companion report's Coverage Gaps.
references:
    - https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/
author: The Hunters Ledger
date: '2026-05-25'
tags:
    - attack.credential-access
    - attack.t1003.001
    - detection.emerging-threats
    - stp.3
logsource:
    category: process_access
    product: windows
detection:
    selection_lsass_access:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess:
            - '0x1010'
            - '0x1410'
            - '0x1fffff'
    condition: selection_lsass_access
falsepositives:
    - Legitimate AV/EDR processes accessing lsass.exe for telemetry; the rule ships no source-process filter, so exclude the sensors deployed in your environment by SourceImage
    - Domain controller synchronization operations
level: medium

Suricata Signatures

Detection Rules

A2A C2 Beacon POST to Operator Endpoint with X-Agent-ID Header

Tier: Detection Robustness: 3 ATT&CK Coverage: T1071.001 (Web Protocols), T1132.001 (Standard Encoding), T1041 (Exfiltration Over C2 Channel) Confidence: HIGH Rationale: Anchors on the operator-bespoke X-Agent-ID header name, the POST method, and the /api/v1/ endpoint family — none of which reference the operator’s specific domain, so the rule survives complete infrastructure rotation. No legitimate web application framework uses this header name in this endpoint naming pattern. Added a literal content prefilter ahead of the URI pcre (not present in the original) so the regex is gated behind a content match per current formatting standards. False Positives: None known — the combination of any of the four paths /api/v1/update, /api/v1/interact, /api/v1/telemetry or /api/v1/get_results with the X-Agent-ID header is operator-bespoke and has no known legitimate-software counterpart. Blind Spots: A rewrite that renames the header and endpoint family evades detection; TLS-encrypted traffic without inline decryption is not inspectable at the HTTP layer by this signature alone (pair with the TLS/JA-fingerprint layer if available). Validation: Replay a PCAP of an A2A C2 beacon check-in — must alert; an unrelated HTTP POST carrying neither the header nor the endpoint pattern must NOT fire. Deployment: Inline or passive HTTP inspection, Zeek http.log, WAF/proxy with content inspection.

alert http $HOME_NET any -> any any (msg:"THL DETECT - A2A C2 Beacon POST to Operator C2 Endpoint with X-Agent-ID Header"; flow:established,to_server; http.method; content:"POST"; http.header_names; content:"X-Agent-ID"; nocase; http.uri; content:"/api/v1/"; pcre:"/\/api\/v1\/(update|interact|telemetry|get_results)/"; reference:url,the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/; classtype:trojan-activity; sid:9000003; rev:3; metadata:author The_Hunters_Ledger, date 2026-05-25;)

Hunting Rules

cloudflared Tunnel Port Egress (UDP 7844 to Any External Host)

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1572 (Protocol Tunneling) ATT&CK Note: The rule sees a destination port only (no SNI, Host header or domain), so Domain Fronting (T1090.004) is not claimed, and a Cloudflare Tunnel is not domain fronting. Confidence: MODERATE Rationale: Cloudflare Tunnel’s control-plane connects to Cloudflare’s edge over UDP/TCP 7844 specifically — Cloudflare’s dedicated tunnel port, not general web QUIC (443) — so this is meaningfully narrower than matching all UDP/443 and does not fire on ordinary browsing or Cloudflare WARP. Wording fix 2026-10-11 (rev 5): the earlier heading and msg said QUIC egress to the Cloudflare edge, but the rule matches any UDP packet from $HOME_NET to any $EXTERNAL_NET address on destination port 7844 (rate-limited per source): it has no Cloudflare address range and no QUIC check. It is a port-based signal that any Cloudflare Tunnel deployment that uses UDP 7844 (legitimate or not), and any other service using UDP 7844, will trigger, and a tunnel that uses TCP 7844 instead does not match this rule, so it stays a hunting lead rather than an alert. Robustness fix 2026-10-11 (round 2): scored 1, not 2: one destination port is the only anchor. False Positives: Legitimate Cloudflare Tunnel deployments also use UDP 7844, and so can any other service that uses that destination port. Deployment: Network flow telemetry / IDS on egress; Zeek conn.log with a UDP/7844 filter. Corroborate with DNS visibility for *.tralalarkefe.com and the campaign’s Cloudflare quick-tunnel subdomain (both carried in the IOC feed) and/or scope the source to segments where Cloudflare Tunnel is not expected.

alert udp $HOME_NET any -> $EXTERNAL_NET 7844 (msg:"THL HUNT - cloudflared Tunnel Port Egress (UDP 7844 to Any External Host)"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/; classtype:policy-violation; sid:9000006; rev:5; metadata:author The_Hunters_Ledger, date 2026-05-25;)

Coverage Gaps

Atomics Retired to the IOC Feed (7 rules: 3 Sigma, 4 Suricata)

Every rule below keyed solely on one hard-coded domain, with no combinatorial or behavioral clause surviving its removal, per the routing test, these are IOC-feed entries, not standalone rules. All underlying domains were already present in russian-gemini-credential-mill-213.165.51.115-iocs.json; no feed edits were required.

• Sigma: Gemini API Egress from Server-Class Infrastructure Host (173cf9ee-97c5-4d51-8487-856f63894ad5): keyed on generativelanguage.googleapis.com (DestinationHostname match). The accompanying filter excluded, rather than isolated, the likely-Python accessing process, so it added no real precision beyond the bare domain match. The domain is preserved in the feed with a MONITOR action and an explicit high false-positive-risk note (it is Google’s own legitimate API domain, abused rather than owned by the operator).
• Sigma: Cloudflare Tunnel Registration to tralalarkefe.com Operator Infrastructure (1003c111-2038-43bc-b463-b5895cd6f408): keyed on tralalarkefe.com in a cloudflared command line. Removing the domain leaves “any cloudflared execution,” which is not malicious on its own; the durable, non-domain-specific version of this technique lead is retained as the Hunting-tier “Cloudflared Access TCP Tunnel to Potentially Unauthorized Hostname” rule above.
• Sigma: Outbound HTTP to AntiPublic.one Credential Database API from Non-Research Host (163023b7-5615-4c9f-9e30-60af0bd2cd8e): keyed on antipublic.one (DestinationHostname match). Preserved in the feed with a MONITOR action.
• Suricata: DNS Query to *.tralalarkefe.com (sid 9000001): keyed on the same root domain as the Sigma entry above; retired for the same reason.
• Suricata: DNS Query to generativelanguage.googleapis.com from Server-Class Hosts (sid 9000002): keyed on the same domain as the Sigma entry above; retired for the same reason.
• Suricata: HTTP Egress to antipublic.one /api/v2/search (sid 9000004): the /api/v2/search URI clause is a generic-sounding REST path with no specificity of its own once the antipublic.one host anchor is removed; retired for the same reason as the Sigma AntiPublic entry.
• Suricata: trycloudflare.com Tunnel Bootstrap DNS from Server Hosts (sid 9000005): keyed on the bare trycloudflare.com suffix, Cloudflare’s entire free quick-tunnel product surface, not an operator-specific atomic. The campaign’s actual atomic (the specific bootstrap subdomain tenant-upcoming-great-descending.trycloudflare.com) is already in the feed; the bare-suffix version added no incremental value and would have been a needlessly broad new feed entry, so it was retired rather than generalized into a new block entry.

Cut Rule

Telegram API Egress with Americanpatriotus Channel Reference (original Sigma rule 8be13baf-aa35-422c-8757-9cfea720af53). The rule’s title and rationale describe detecting posting activity to the @americanpatriotus channel, but the YAML detection: logic never actually references that channel identifier anywhere; Sigma cannot inspect TLS-encrypted message bodies, so the channel name was never encodable in the first place. As written, the logic reduces to “api.telegram.org DNS/network match AND a Python process,” which the original text itself acknowledged is common in legitimate bot deployments (“False Positive Risk: HIGH”). With the channel-specific claim removed, nothing distinguishing survives; this fires on ubiquitous, legitimate Telegram-bot activity with no pivot value, and does not clear the precision bar even for Hunting. What would enable a rule: TLS-inspecting proxy visibility into the message body, or a Telegram Bot API token/chat-ID specific to this operator’s bot (neither was recovered from this investigation).

Techniques Observed But Not Fully Covered

1. LLM-Vendor-Side Detection (Gemini API abuse telemetry). The operator’s check_keys.py validates 40+ stolen Gemini API keys against Google’s model-listing endpoint with high key-diversity from a single source IP. Detecting this key-rotation pattern requires server-side telemetry from Google’s Generative Language API, specifically, /v1beta/models calls where a single source IP cycles through >10 distinct ?key= values within 60 seconds. This is beyond standard defender scope, and beyond what a domain-match Sigma/Suricata rule can encode (see the retired Gemini-egress entries above). Coordination path: Google Trust & Safety, with the operator’s full key inventory.

2. Telegram Disinformation Content Detection. The quantum_patriot.py script posts AI-rewritten RSS content to @americanpatriotus via the Telegram Bot API. Distinguishing this channel’s AI-generated content from organic political posting requires semantic content classification beyond standard SOC capability and beyond what any network-layer Sigma/Suricata rule can encode. See the Cut rule above. Coordination path: Telegram Trust & Safety for the @americanpatriotus channel, independently corroborated by Trend Micro (2026-05-22).

3. GitHub PAT Abuse Correlation. The operator’s GitHub PAT is used for repository management and potentially exfiltration of victim artifacts via GitHub as an exfil channel (T1567.002). Per-PAT API call correlation across GitHub infrastructure requires GitHub Trust & Safety coordination. Coordination path: GitHub Trust & Safety, with the operator’s account identifiers.

4. Per-Victim Cloudflare Tunnel Access Detection. The operator’s windows_server.tralalarkefe.com and gil_dr1.tralalarkefe.com Cloudflare Tunnel endpoints provided persistent RDP and SSH access to the victim machines at capture time. Detecting specific victim-machine beacon activity on these tunnels from the defender’s side requires either victim-side egress logs or Cloudflare PSIRT coordination. The domain-level DNS signal for these subdomains lives in the IOC feed rather than as a standalone rule (see Atomics Retired above); the port-based QUIC/7844 Hunting rule above provides a domain-independent fallback signal.

5. agent_final.ps1 PowerShell Beacon (Binary Not Captured). The victim-side PowerShell beacon agent_final.ps1 is referenced extensively in the operator’s handoff documents, but the binary itself was not recovered; rules for it are derived from the C2 server’s endpoint-contract specification rather than direct code analysis. If the beacon is later recovered, the following indicators should enable high-confidence matching: X-Agent-ID: HOSTNAME_username header format, 5-second beacon interval to /api/v1/update, Mozilla/5.0 (Windows NT 10.0; Win64; x64) User-Agent, base64(UTF-16LE) body encoding on /api/v1/telemetry POST.

6. WMI EventConsumer Fileless Persistence (stealth.ps1). The operator’s C2_MIGRATION_GUIDE.md references a stealth.ps1 script providing WMI EventConsumer + EventFilter + FilterToConsumerBinding triplet persistence, in addition to the HKCU Registry Run key covered above. The stealth.ps1 binary was not recovered; generic WMI subscription persistence detection (Sysmon Event ID 19/20/21 matching \\.\root\subscription) covers the technique pattern but cannot provide operator-specific file/value-name signatures without direct binary access.

7. NTLM Dump → Cloudflare Tunnel Exfiltration (Full Temporal Correlation). The Detection-tier “Suspicious LSASS Process Access via High-Privilege GrantedAccess Mask” Sigma rule above captures only the LSASS-access stage of the operator’s documented two-stage sequence (dump, then exfiltrate via Cloudflare Tunnel within roughly 10 minutes). A full temporal_ordered Sigma correlation joining LSASS access to Cloudflare Tunnel/trycloudflare.com egress by host within a 10-minute window was not attempted in this backfill; the cross-event-type group-by field alignment (process-access telemetry vs. network-connection telemetry) needs validation against a live SIEM schema before publication. What would enable this: confirming the common host-identifier field name across both log sources in the target deployment.

8. OpenDental MySQL Hash Reuse / Database Access. The operator holds the OpenDental MySQL root hash from the primary named victim. Detection of unauthorized OpenDental database access would require MySQL audit logging at the victim’s practice-management server, out of scope for a third-party detection provider. Coordination path: Direct victim notification (via HC3/HHS OCR HIPAA track).

License

Detection rules are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Free to use, including commercially, with attribution to The Hunters Ledger.

@misc{hunters-ledger-russian-gemini-credential-mill-213-165-51-115-detections,
  author       = {Harrison, Joseph},
  title        = {Detection Rules — Russian Gemini Credential Mill (213.165.51.115)},
  howpublished = {The Hunter's Ledger},
  year         = {2026},
  month        = {may},
  url          = {https://the-hunters-ledger.com/hunting-detections/russian-gemini-credential-mill-213.165.51.115-detections/},
  note         = {Published 25 May 2026. Licensed CC BY 4.0.}
}