UTA0565 CLEANGULP IOC hunt across domains, IP, and file hashes

Arnold Chan@slaz

•updated Sep 23, 2026•0•0•5

This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.