MexicanMafia Kimera Recon Framework - subfinder/gobuster/dnsx/naabu Execution

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects the execution of various reconnaissance tools and scripts identified as part of the Kimera framework, utilized by the threat actor group MexicanMafia in Operation Escaneo. This rule monitors for specific tool names (subfinder, assetfinder, gobuster, dnsx, naabu, httpx, gowitness, findomain), associated Python scripts, and specific command-line arguments indicative of aggressive scanning behavior.