THL-ARPA-006 DNS Query to OpenClaw Distribution or Skill-Marketplace Domain - Potential Operator Framework Presence - Suricata Rule 1900096 (hunters-ledger)

Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 5, 2026, 4:07 AM

THL-ARPA-006 DNS Query to OpenClaw Distribution or Skill-Marketplace Domain - Potential Operator Framework Presence

SID: 1900096Rev: 1Enabled5 viewsHistory

Sourcehunters-ledger

Filehunters-ledger.rules

CreatedJune 25, 2026

UpdatedJune 25, 2026

Classificationpolicy-violation

alert dns $HOME_NET any -> any any (msg:"THL-ARPA-006 DNS Query to OpenClaw Distribution or Skill-Marketplace Domain - Potential Operator Framework Presence"; dns.query; content:"openclaw.ai"; nocase; sid:1900096; rev:1; classtype:policy-violation; metadata:author The_Hunters_Ledger, campaign Turkish-ARPA-State-Insurer, created 2026-05-26, mitre_attack T1588;)

Metadata

authorThe_Hunters_Ledger

campaignTurkish-ARPA-State-Insurer

created2026-05-26

mitre attackT1588

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!