THL-ARPA-002 HTTP Egress to ARPA Operator Platform - Active C2 Ingestion or Dashboard Access - Suricata Rule 1900092 (hunters-ledger)

THL-ARPA-002 HTTP Egress to ARPA Operator Platform - Active C2 Ingestion or Dashboard Access

SID: 1900092Rev: 1Enabled2 views

Filehunters-ledger.rules

CreatedJune 25, 2026

UpdatedJune 25, 2026

Classificationtrojan-activity

alert http $HOME_NET any -> 209.38.205.158 any (msg:"THL-ARPA-002 HTTP Egress to ARPA Operator Platform - Active C2 Ingestion or Dashboard Access"; http.uri; content:"/api/"; flow:to_server,established; sid:1900092; rev:1; classtype:trojan-activity; metadata:author The_Hunters_Ledger, campaign Turkish-ARPA-State-Insurer, created 2026-05-26, mitre_attack T1041;)

Metadata

authorThe_Hunters_Ledger

campaignTurkish-ARPA-State-Insurer

created2026-05-26

mitre attackT1041

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!