APT36 Operation RapidRust IOC hunt: hashes, domains, staging URLs

Arnold Chan@slaz

•updated Sep 18, 2026•0•0•3

This rule detects potential malicious activity by matching endpoint file events against a known list of malicious file hashes (SHA256, SHA1, MD5) and monitoring for connections to known malicious domains or URLs.