Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 5, 2026, 4:07 AM

THL BellaMain PhaaS USOM Blocklist Poll from Web Server

SID: 1900009Rev: 1Enabled2 viewsHistory
Filehunters-ledger.rules
CreatedJune 25, 2026
UpdatedJune 25, 2026
Classificationpolicy-violation
alert http $HOME_NET any -> any any (msg:"THL BellaMain PhaaS USOM Blocklist Poll from Web Server"; flow:established,to_server; http.host; content:"usom.gov.tr"; endswith; http.uri; content:"url-list.txt"; nocase; threshold:type limit, track by_src, count 1, seconds 300; classtype:policy-violation; sid:1900009; rev:1; reference:url,the-hunters-ledger.com/hunting-detections/bellamain-turkish-phaas-79-137-192-3-20260516-detections/; metadata:author The_Hunters_Ledger, date 2026-05-16, mitre_technique T1518.001;)

References

urlthe-hunters-ledger.com/hunting-detections/bellamain-turkish-phaas-79-137-192-3-20260516-detections/

Metadata

authorThe_Hunters_Ledger
date2026-05-16
mitre techniqueT1518.001

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!