IOC Hunt: The Gentlemen TukTuk C2 Network/File/Hash Indicators
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
Splunk (SPL)
