THL HUNT AI-Agent-Campaign Hysteria v2 QUIC bing.com SNI Masquerade — Non-Microsoft Destination (GHOST Kit Backdoor) - Suricata Rule 3500003 (hunters-ledger)

THL HUNT AI-Agent-Campaign Hysteria v2 QUIC bing.com SNI Masquerade — Non-Microsoft Destination (GHOST Kit Backdoor)

SID: 3500003Rev: 1Enabled2 views

Filehunters-ledger.rules

CreatedJuly 5, 2026

UpdatedJuly 5, 2026

Classificationtrojan-activity

alert udp $HOME_NET any -> any 443 (msg:"THL HUNT AI-Agent-Campaign Hysteria v2 QUIC bing.com SNI Masquerade — Non-Microsoft Destination (GHOST Kit Backdoor)"; content:"|00 00|"; offset:0; content:"bing.com"; nocase; content:"|00 01|"; classtype:trojan-activity; threshold:type limit,track by_src,count 1,seconds 3600; sid:3500003; rev:1; metadata:author The_Hunters_Ledger, date 2026-05-25, reference https://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/;)

Metadata

authorThe_Hunters_Ledger

date2026-05-25

referencehttps://the-hunters-ledger.com/hunting-detections/ai-agent-frameworks-2026-05-23-detections/

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!