Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 5, 2026, 4:07 AM

THL BellaMain CryptOne Fake Exchange Domain DNS Query cryptone.bot

SID: 1900010Rev: 1Enabled9 viewsHistory
Filehunters-ledger.rules
CreatedJune 25, 2026
UpdatedJune 25, 2026
Classificationtrojan-activity
alert dns $HOME_NET any -> any any (msg:"THL BellaMain CryptOne Fake Exchange Domain DNS Query cryptone.bot"; flow:established; dns.query; content:"cryptone.bot"; endswith; nocase; classtype:trojan-activity; sid:1900010; rev:1; metadata:author "The Hunters Ledger", date "2026-05-16", mitre_technique "T1071.001", reference "https://the-hunters-ledger.com/hunting-detections/bellamain-turkish-phaas-79-137-192-3-20260516-detections/";)

Metadata

author"The Hunters Ledger"
date"2026-05-16"
mitre technique"T1071.001"
reference"https://the-hunters-ledger.com/hunting-detections/bellamain-turkish-phaas-79-137-192-3-20260516-detections/"

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!