THL HUNT AI-Agent-Campaign Mining Pool DNS Query — c3pool / nanopool / xmrig.com (Cryptojacker Activity) - Suricata Rule 1900002 (hunters-ledger)

Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 5, 2026, 4:07 AM

THL HUNT AI-Agent-Campaign Mining Pool DNS Query — c3pool / nanopool / xmrig.com (Cryptojacker Activity)

SID: 1900002Rev: 1Enabled1 viewsHistory

Sourcehunters-ledger

Filehunters-ledger.rules

CreatedJune 25, 2026

UpdatedJune 25, 2026

Classificationtrojan-activity

alert dns $HOME_NET any -> any any (msg:"THL HUNT AI-Agent-Campaign Mining Pool DNS Query — c3pool / nanopool / xmrig.com (Cryptojacker Activity)"; dns_query; pcre:"/(?:c3pool\.org|nanopool\.org|xmrig\.com|moneroocean\.stream|hashvault\.pro)/i"; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1900002; rev:1; metadata:author The_Hunters_Ledger, date 2026-05-25, reference https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/;)

Metadata

authorThe_Hunters_Ledger

date2026-05-25

referencehttps://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!