THL HUNT GSocket-THC-Relay gsocket.io Domain Query (Hunt-Only - Do Not Block - Shared Public Infrastructure) - Suricata Rule 3500175 (hunters-ledger)

THL HUNT GSocket-THC-Relay gsocket.io Domain Query (Hunt-Only - Do Not Block - Shared Public Infrastructure)

SID: 3500175Rev: 1Enabled2 views

Filehunters-ledger.rules

CreatedJuly 27, 2026

UpdatedJuly 27, 2026

Classificationmisc-activity

alert dns $HOME_NET any -> any any (msg:"THL HUNT GSocket-THC-Relay gsocket.io Domain Query (Hunt-Only - Do Not Block - Shared Public Infrastructure)"; dns_query; content:"gsocket.io"; nocase; isdataat:!1,relative; threshold:type limit,track by_src,count 1,seconds 3600; classtype:misc-activity; sid:3500175; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-17, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/, signature_severity Informational;)

Metadata

authorThe_Hunters_Ledger

date2026-07-17

referencehttps://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/

signature severityInformational

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!