THL HUNT GSocket-THC-Relay gs.thc.org NAT-Traversal Domain Query (Hunt-Only - Do Not Block - Shared Public Infrastructure) - Suricata Rule 3500174 (hunters-ledger)

THL HUNT GSocket-THC-Relay gs.thc.org NAT-Traversal Domain Query (Hunt-Only - Do Not Block - Shared Public Infrastructure)

SID: 3500174Rev: 1Enabled2 views

Filehunters-ledger.rules

CreatedJuly 27, 2026

UpdatedJuly 27, 2026

Classificationmisc-activity

alert dns $HOME_NET any -> any any (msg:"THL HUNT GSocket-THC-Relay gs.thc.org NAT-Traversal Domain Query (Hunt-Only - Do Not Block - Shared Public Infrastructure)"; dns_query; content:".gs.thc.org"; nocase; isdataat:!1,relative; threshold:type limit,track by_src,count 1,seconds 3600; classtype:misc-activity; sid:3500174; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-17, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/, signature_severity Informational;)

Metadata

authorThe_Hunters_Ledger

date2026-07-17

referencehttps://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/

signature severityInformational

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!