RH7.NINJA

# ==============================================
# rh7.ninja C2 DETECTION RULES (CLEAN)
# Only fires on ACTUAL C2 traffic patterns
# ==============================================

# DNS: rh7.ninja domain lookups (the one that always works)
alert dns any any -> any any (msg:"C2 DNS - rh7.ninja domain lookup"; dns.query; content:"rh7.ninja"; classtype:trojan-activity; sid:1000006; rev:1;)

# Sliver C2: repeated TLS beacons from same source (beacon behavior)
alert tls any any -> 143.198.125.30 4443 (msg:"C2 BEACON - Repeated TLS to Sliver port 4443"; flow:to_server,established; threshold:type both, track by_src, count 3, seconds 120; classtype:trojan-activity; sid:1000001; rev:2;)

# Sliver C2: TLS with self-signed multiplayer cert (Sliver default)
alert tls any any -> 143.198.125.30 4443 (msg:"C2 TLS - Sliver self-signed cert detected"; flow:to_server,established; tls.cert_subject; content:"CN=multiplayer"; classtype:trojan-activity; sid:1000007; rev:2;)

# HTTP staging callback
alert http any any -> 143.198.125.30 8080 (msg:"C2 HTTP - Sliver staging on port 8080"; flow:to_server,established; classtype:trojan-activity; sid:1000002; rev:1;)

# Phishing: auth subdomain access
alert http any any -> 143.198.125.30 any (msg:"PHISHING - auth.rh7.ninja access"; http.host; content:"auth.rh7.ninja"; classtype:social-engineering; sid:1000003; rev:1;)

# Implant download: EXE from CDN
alert http any any -> 143.198.125.30 any (msg:"C2 IMPLANT - EXE download from CDN"; http.uri; content:".exe"; http.host; content:"cdn.rh7.ninja"; classtype:trojan-activity; sid:1000004; rev:1;)

# Implant download: ARM binary from CDN
alert http any any -> 143.198.125.30 any (msg:"C2 IMPLANT - ARM binary download"; http.uri; content:"arm-agent"; http.host; content:"cdn.rh7.ninja"; classtype:trojan-activity; sid:1000010; rev:1;)

# Phishing: POST credential submission
alert http any any -> 143.198.125.30 any (msg:"PHISHING - Credential POST to auth"; http.method; content:"POST"; http.host; content:"auth.rh7.ninja"; classtype:social-engineering; sid:1000009; rev:1;)

# Azure Front Door health probe noise filter - suppress
alert tls any any -> 143.198.125.30 443 (msg:"AZURE CDN - Front door health probe"; flow:to_server,established; tls.cert_subject; content:"CN=*.azureedge.net"; threshold:type threshold, track by_src, count 10, seconds 60; classtype:not-suspicious; sid:2000001; rev:1;)