BINDCLOAK — published hashes, C2 domains, IP, and cert serial

Ankit Mehta@Secvyn

•updated Aug 5, 2026•2•0•6

This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.