THL - AdaptixC2 Stock Listener URI Path with Firefox 20 UA - Suricata Rule 3500063 (hunters-ledger)

THL - AdaptixC2 Stock Listener URI Path with Firefox 20 UA

SID: 3500063Rev: 1Enabled5 viewsHistory

Filehunters-ledger.rules

CreatedMarch 17, 2026

UpdatedJuly 5, 2026

Classificationtrojan-activity

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"THL - AdaptixC2 Stock Listener URI Path with Firefox 20 UA"; flow:established,to_server; http.user_agent; content:"Mozilla/5.0 (Windows NT 6.2|3B| rv:20.0) Gecko/20121202 Firefox/20.0"; endswith; http.method; content:"POST"; http.uri; content:"/api/v1/status"; nocase; reference:url,the-hunters-ledger.com/reports/opendirectory-45-130-148-125-20260430/; classtype:trojan-activity; sid:3500063; rev:1;)

References

url	the-hunters-ledger.com/reports/opendirectory-45-130-148-125-20260430/

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!