Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 13, 2026, 4:10 PM
THL OpenStrike C2 Infrastructure Contact 172.105.0.126:8443
alert tcp $HOME_NET any -> 172.105.0.126 8443 (msg:"THL OpenStrike C2 Infrastructure Contact 172.105.0.126:8443" ; flow:established,to_server ; flags:S+; sid:3500050; rev:1; metadata:affected_product Windows, attack_target Client_Endpoint, created_at 2026_04_06, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2026_04_06;)
Metadata
affected productWindows
attack targetClient_Endpoint
created at2026_04_06
deploymentPerimeter
performance impactLow
signature severityMajor
updated at2026_04_06
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!