Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 13, 2026, 4:10 PM

THL - Outbound to AntiPublic.one Credential-DB API /api/v2/search (Credential Operator Tool)

SID: 3500094Rev: 1Enabled5 viewsHistory
Filehunters-ledger.rules
CreatedApril 4, 2026
UpdatedJuly 6, 2026
Classificationpolicy-violation
alert http $HOME_NET any -> any any (msg:"THL - Outbound to AntiPublic.one Credential-DB API /api/v2/search (Credential Operator Tool)"; flow:established,to_server; http.host; content:"antipublic.one"; endswith; http.uri; content:"/api/v2/search"; startswith; classtype:policy-violation; sid:3500094; rev:1; metadata:author "The Hunters Ledger", campaign "OpenDirectory-RussianGeminiCredentialMill-213.165.51.115", mitre_tactic "credential-access collection", mitre_technique "T1213 T1078", confidence HIGH, created_at 2026-05-25;)

Metadata

author"The Hunters Ledger"
campaign"OpenDirectory-RussianGeminiCredentialMill-213.165.51.115"
mitre tactic"credential-access collection"
mitre technique"T1213 T1078"
confidenceHIGH
created at2026-05-25

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!