Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 13, 2026, 4:10 PM

THL-ARPA-002 HTTP Egress to ARPA Operator Platform - Active C2 Ingestion or Dashboard Access

SID: 3500107Rev: 1Enabled10 viewsHistory
Filehunters-ledger.rules
CreatedJuly 5, 2026
UpdatedJuly 6, 2026
Classificationtrojan-activity
alert http $HOME_NET any -> 209.38.205.158 any (msg:"THL-ARPA-002 HTTP Egress to ARPA Operator Platform - Active C2 Ingestion or Dashboard Access"; sid:3500107; rev:1; classtype:trojan-activity; metadata:author The_Hunters_Ledger, campaign Turkish-ARPA-State-Insurer, created 2026-05-26, mitre_attack T1041;)
Detection details are hidden.

Metadata

authorThe_Hunters_Ledger
campaignTurkish-ARPA-State-Insurer
created2026-05-26
mitre attackT1041

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!