THL HUNT GSocket-THC-Deploy gsocket.io Installer Retrieval TLS SNI (Hunt-Only - Do Not Block - Shared Public Infrastructure) - Suricata Rule 3500199 (hunters-ledger)

THL HUNT GSocket-THC-Deploy gsocket.io Installer Retrieval TLS SNI (Hunt-Only - Do Not Block - Shared Public Infrastructure)

SID: 3500199Rev: 1Enabled2 views

Filehunters-ledger.rules

CreatedAugust 21, 2026

UpdatedAugust 21, 2026

Classificationmisc-activity

alert tls $HOME_NET any -> any any (msg:"THL HUNT GSocket-THC-Deploy gsocket.io Installer Retrieval TLS SNI (Hunt-Only - Do Not Block - Shared Public Infrastructure)"; flow:established,to_server; tls.sni; content:"gsocket.io"; fast_pattern; nocase; endswith; threshold:type limit,track by_src,count 1,seconds 3600; classtype:misc-activity; sid:3500199; rev:1; metadata:author The_Hunters_Ledger, date 2026-08-21, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/, signature_severity Informational;)

Metadata

authorThe_Hunters_Ledger

date2026-08-21

referencehttps://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/

signature severityInformational

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!