# Hydra Bot v5 — Network Detection Rules (Suricata)
# Reference: research.ohiiho.com
# Date: 2026-09-01
# SID range: 2026090100-2026090120
# License: Free to use with attribution.

# --- Redis SLAVEOF/REPLICAOF to known C2 ---

alert tcp $HOME_NET any -> 47.95.111.169 6536 (msg:"HYDRA-BOT-V5 Redis SLAVEOF to known C2 47.95.111.169:6536"; flow:to_server,established; content:"SLAVEOF"; nocase; content:"47.95.111.169"; sid:2026090100; rev:1; metadata:severity high, created_at 2026_09_01;)

alert tcp $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 Generic Redis SLAVEOF command"; flow:to_server,established; content:"SLAVEOF"; nocase; content:!"|0d 0a|NO ONE"; sid:2026090101; rev:1; metadata:severity medium, created_at 2026_09_01;)

alert tcp $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 Generic Redis REPLICAOF command"; flow:to_server,established; content:"REPLICAOF"; nocase; content:!"|0d 0a|NO ONE"; sid:2026090102; rev:1; metadata:severity medium, created_at 2026_09_01;)

# --- Redis MODULE LOAD from temp ---

alert tcp $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 Redis MODULE LOAD from /tmp/"; flow:to_server,established; content:"MODULE"; nocase; content:"LOAD"; nocase; content:"/tmp/"; sid:2026090103; rev:1; metadata:severity critical, created_at 2026_09_01;)

# --- Redis CONFIG SET targeting cron/SSH directories ---

alert tcp $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 Redis CONFIG SET dir to cron path"; flow:to_server,established; content:"CONFIG"; nocase; content:"SET"; nocase; content:"dir"; nocase; content:"/var/spool/cron"; sid:2026090104; rev:1; metadata:severity critical, created_at 2026_09_01;)

alert tcp $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 Redis CONFIG SET dir to SSH path"; flow:to_server,established; content:"CONFIG"; nocase; content:"SET"; nocase; content:"dir"; nocase; content:".ssh"; sid:2026090105; rev:1; metadata:severity critical, created_at 2026_09_01;)

alert tcp $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 Redis CONFIG SET dir to cron.d"; flow:to_server,established; content:"CONFIG"; nocase; content:"SET"; nocase; content:"dir"; nocase; content:"/etc/cron"; sid:2026090106; rev:1; metadata:severity critical, created_at 2026_09_01;)

# --- CVE-2022-0543 Lua sandbox escape ---

alert tcp $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 Redis CVE-2022-0543 Lua Sandbox Escape"; flow:to_server,established; content:"EVAL"; nocase; content:"package.loadlib"; content:"luaopen_io"; sid:2026090107; rev:1; reference:cve,2022-0543; metadata:severity critical, created_at 2026_09_01;)

# --- HTTP payload delivery ---

alert http $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 HTTP GET for ha-fixed.sh stager"; flow:to_server,established; content:"GET"; http_method; content:"/ha-fixed.sh"; http_uri; sid:2026090108; rev:1; metadata:severity high, created_at 2026_09_01;)

alert http $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 HTTP GET for mini-agent-v2"; flow:to_server,established; content:"GET"; http_method; content:"/mini-agent-v2"; http_uri; sid:2026090109; rev:1; metadata:severity high, created_at 2026_09_01;)

alert http $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 HTTP GET for xmrig miner"; flow:to_server,established; content:"GET"; http_method; content:"/xmrig"; http_uri; sid:2026090110; rev:1; metadata:severity high, created_at 2026_09_01;)

alert http any any -> $HOME_NET any (msg:"HYDRA-BOT-V5 HTTP response serving stager"; flow:to_client,established; content:"Hydra Bot v5"; sid:2026090111; rev:1; metadata:severity high, created_at 2026_09_01;)

# --- C2 connections ---

alert tcp $HOME_NET any -> 152.89.236.100 31337 (msg:"HYDRA-BOT-V5 Connection to C2 port 31337 (kasemaster.es)"; flow:to_server; sid:2026090112; rev:1; metadata:severity critical, created_at 2026_09_01;)

alert tcp $HOME_NET any -> 152.89.236.100 9999 (msg:"HYDRA-BOT-V5 Connection to C2 HTTP port 9999"; flow:to_server; sid:2026090113; rev:1; metadata:severity high, created_at 2026_09_01;)

alert tcp $HOME_NET any -> 47.95.111.169 6536 (msg:"HYDRA-BOT-V5 Connection to Redis C2 port 6536"; flow:to_server; sid:2026090114; rev:1; metadata:severity high, created_at 2026_09_01;)

# --- Mining pool ---

alert dns $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 DNS query for MoneroOcean pool"; content:"moneroocean"; nocase; content:"stream"; nocase; sid:2026090115; rev:1; metadata:severity medium, created_at 2026_09_01;)

# --- Operator domain ---

alert dns $HOME_NET any -> any any (msg:"HYDRA-BOT-V5 DNS query for kasemaster.es"; content:"kasemaster"; nocase; content:"es"; nocase; sid:2026090116; rev:1; metadata:severity high, created_at 2026_09_01;)