Rapuncel/Cruciferra BYOVD campaign IOC hunt (hashes, C2 IP, domains)

Arnold Chan@slaz

•updated Sep 19, 2026•1•0•5

This rule monitors for indicators of compromise (IOCs) associated with the Rapuncel/Cruciferra 'Bring Your Own Vulnerable Driver' (BYOVD) malware-as-a-service (MaaS) campaign. It detects malicious file hashes (associated with dropped binaries or drivers), connections to known malicious command-and-control (C2) IP addresses, and network requests to domains used by the infrastructure.