The Gentlemen TukTuk C2 Network/File/Hash Indicators IOC Hunt

Arnold Chan@slaz

•updated Sep 21, 2026•0•0•3

This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.