CARBONATO GH0ST Hermes Agent SOUL.md persona overwrite

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects the deployment of the CARBONATO botnet's Hermes Agent within containerized environments. The rule identifies specific artifacts such as the 'SOUL.md' persona configuration, 'netd-svc' container references, and indicators of AI-focused credential theft (e.g., searching for OpenAI or Anthropic API keys) orchestrated by the GH0ST AI agent.