THL HUNT GHOST Cryptojacker Kit Hysteria v2 QUIC Initial Inbound to Victim-Hosted Listener Ports (Hunt Lead, Corroborate Before Escalating)

SID: 3500211Rev: 1Enabled0 views
Filehunters-ledger.rules
CreatedSeptember 30, 2026
UpdatedSeptember 30, 2026
Classificationpolicy-violation
alert udp $EXTERNAL_NET any -> $HOME_NET 14433:14444 (msg:"THL HUNT GHOST Cryptojacker Kit Hysteria v2 QUIC Initial Inbound to Victim-Hosted Listener Ports (Hunt Lead, Corroborate Before Escalating)"; dsize:>=1200; byte_test:1,=,0xC,0,bitmask 0xF0; content:"|00 00 00 01|"; offset:1; depth:4; threshold:type limit,track by_dst,count 1,seconds 3600; classtype:policy-violation; sid:3500211; rev:1; metadata:author The_Hunters_Ledger, date 2026-09-30, reference https://the-hunters-ledger.com/hunting-detections/ghost-cryptojacker-vova75rus-77.110.96.200-detections/, signature_severity Minor, tag Backdoor, tag GHOST_kit, tag Hysteria_v2;)

Metadata

authorThe_Hunters_Ledger
date2026-09-30
referencehttps://the-hunters-ledger.com/hunting-detections/ghost-cryptojacker-vova75rus-77.110.96.200-detections/
signature severityMinor
tagHysteria_v2

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!