Accenture Security APEX Labs
IOCs & detection

We publish findings from Accenture Cyber Intelligence research to help defenders detect and respond to active threats. Reports bring together indicators of compromise, YARA detection rules, network fingerprints and mitigation guidance, ready to use in your own tools. All content is TLP:CLEAR, so you're free to use and share it.

Published reports

Threat intelligence alert ·
AI agents weaponizing stolen source code to find zero-days
Accenture Cyber Intelligence (CI) has identified an active, AI-enabled hacking campaign using semi-autonomous AI agents to conduct reconnaissance, discover vulnerabilities, and gain initial access to organizations, primarily observed across the Asia-Pacific region. Includes 39 IP addresses.
Asia-Pacific GitHub AI agents
Malware intelligence ·
Settra Blinder — IOCs & detection
Indicators of compromise, technical analysis, and YARA detection rule for Settra Blinder — a 64-bit Windows EDR evasion toolkit exploiting vulnerable kernel drivers via BYOVD techniques to blind endpoint defences.
Windows x64 EDR evasion
Malware intelligence · · Updated
RustyRocket — IOCs & detection
Indicators of compromise, YARA detection rules, and network fingerprints for the RustyRocket implant family — covering Windows and Linux agents, proxies, and the RocketLaunch service installer. Includes 24 sample hashes and JA4/JA3 TLS fingerprints.
Windows Linux Network fingerprints

What reports include

Threat analysis

Technical findings on malware and attacker tooling

Indicators

File hashes and IP addresses of known threat activity

Detection rules

YARA rules for files and memory on Windows and Linux

Network fingerprints

JA4 and JA3 TLS fingerprints and protocol indicators

Mitigation

Practical guidance for detection and response

Using this intelligence

Indicators

Add the sample hashes to EDR blocklists and SIEM watchlists, and search historical endpoint telemetry for earlier executions. Add IP addresses to firewall and proxy blocklists, and search network and authentication logs for past connections.

IP addresses are published defanged (for example, 23.95.119[.]178): replace [.] with . before loading them.

Network fingerprints

Alert on the JA4 and JA3 fingerprints in your NDR or SIEM pipeline, and prefer JA4 where your tooling supports it. Other software built on the same TLS library can share a fingerprint, so check destination, SNI and host context before blocking.

YARA rules

Copy a rule from its report page, save it as a .yar file and run it with the YARA command-line tool. You can also load it into any EDR, sandbox or file-scanning pipeline that accepts YARA rules.

# Scan a directory recursively and print the matching strings
yara -r -s rule.yar /path/to/scan

# Scan the memory of a running process (usually needs administrator or root rights)
yara -s rule.yar <PID>

Some rules import YARA modules such as pe or elf, which are included in standard YARA builds.

Mitigation guidance

Each report ends with recommendations specific to the threat. Use them to prioritise hardening and monitoring work.

Test before you block

Run new rules in alert-only mode first to measure false positives in your environment.

Sharing and feedback

Traffic Light Protocol

All content on this site is marked TLP:CLEAR under FIRST TLP 2.0. Recipients may share it without restriction, subject to standard copyright rules.

You are welcome to load the indicators and rules into your own tools and to redistribute them. Please credit Accenture Security APEX Labs. Keep the rule metadata (author, date, version) intact so others can trace updates.

Feedback

If a rule produces false positives, misses a sample it should catch, or a report contains an error, please open an issue on GitHub. Include the report and rule name, the rule version, your YARA version, and the SHA-256 of any file involved.

Do not attach malware samples to issues, and do not post client, personal or other sensitive data.

About

Accenture Security APEX Labs (Adversary Pursuit, Engagement, and Exploitation) publishes the reports on this site. They share indicators, detection rules and mitigation guidance from Accenture Cyber Intelligence research with the wider defender community.

Accenture Cyber Intelligence (CI) provides advanced threat intelligence, adversary research and detection capabilities to help organisations stay ahead of emerging threats.

For more about Accenture's security services, visit Accenture Cybersecurity.