Detect Hashtopolis agent network activity

Kaung Khant Ko@kaungkhantko

•updated Jun 23, 2026•0•0•3

This rule detects network activity associated with the Hashtopolis agent. Specifically, it looks for the string "hashtopolis" within the HTTP User-Agent header of traffic flowing from a client to a server. This activity is linked to the 'FortiBleed campaign', which involves distributed offline cracking of SHA-256 FortiGate administrator credential hashes.