Detections 52 files
Deployable YARA, Sigma, Suricata, and IOC artefacts derived from OHIIHO research.
Download directly — no GitHub account required. Free to use with attribution.
Campaign packs
Full detection sets tied to a specific threat actor or campaign — YARA + Sigma + IOCs.
Finding family: Exposure
Hydra Bot v5
Redis Stager + P2PInfect
Read report →Finding family: Engagement
Sorry Worm / Diicot
Linux Ransomware + SSH Botnet
YARA: binary strings .yar
YARA: encrypted files .yar
Sigma: ransomware drop .yml
Sigma: loader cleanup .yml
Sigma: process masquerade .yml
IOCs: playbook CSV
IOCs: catching CSV
Read report →Finding family: Engagement
Watcher / NetAI-SKN
Dual-Stage Linux Loader
YARA: loader + SKN .yar
Sigma: process creation .yml
Sigma: C2 network .yml
Sigma: loader callback .yml
Sigma: systemd persistence .yml
IOCs CSV
Read report →Crimeware arsenal — 27 YARA rules
One YARA rule per crimeware tool recovered from live adversary sessions.
IOC files
Machine-readable indicator files from published reports.
Turf Wars at Scale: Botnets Fighting for the Same ServersCSV
Prometei Goes Both Ways: Same C2, Both Operating Systems, Three Months Apart [1/2]CSV
Two-Way Prometei: When the Linux Botnet Pivots Back to Windows [2/2]CSV
Outlaw/mdrfckr relay activity from Syrian institutional IP spaceCSV
Residential Broadband Botnet Uses AsyncSSH to Validate Credentials Across Four RegionsCSV
FortiBleed Credential-Validation Spray: Detection BriefCSV
FortiBleed from the Target Side: The Corpus [1/3]CSV
FortiBleed from the Target Side: What Stops Them [3/3]CSV
25 detection files across 12 reports and briefs, plus 27 arsenal YARA rules. Packs grow as new reports are published. For rule updates or custom indicators, contact research@ohiiho.com.