Skip to content
skopnix
Detections · Rule
← IBM QRadar detectionsIBM QRadar · Actor indicator sweep

Tortoiseshell file hash indicators

AQLhighconfidence 76/100generated 2026-10-18

Any of 4 high-confidence file hash indicators skopnix attributes to Tortoiseshell.

ATT&CK
T1204.002 mitre ↗
Linked actors
Tortoiseshell
False positives
Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 76 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

AQL search

skopnix-qradar-actor-tortoiseshell-hash-a58eeb4d.aqldownload .aql ↓
SELECT sourceip, username, QIDNAME(qid) AS event, LOGSOURCENAME(logsourceid) AS log_source, "File Hash"
FROM events
WHERE REFERENCESETCONTAINS('Skopnix: Tortoiseshell - file hashs', "File Hash")
LAST 7 DAYS

CRE rule (build in Offenses > Rules)

download .txt ↓
Rule name: "Skopnix: Tortoiseshell file hash match"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [any]
  - and when any of File Hash is contained in any of Reference Set - "Skopnix: Tortoiseshell - file hashs"
  - and NOT when an event matches any of the following BB:Skopnix Known-Good Exclusions
Response: dispatch new event / create offense indexed by Username; annotate "Skopnix hash match".
FP-safety: BB:Skopnix Known-Good Exclusions = RFC1918 + the customer's known-good destinations; the set only ever holds skopnix high-confidence, multi-source, warninglist-clean indicators (time-to-live 730 days, timeout on last seen).

Reference set · Skopnix: Tortoiseshell - file hashs

download .json ↓
{
 "name": "Skopnix: Tortoiseshell - file hashs",
 "element_type": "ALNIC",
 "element_type_label": "AlphaNumeric (Ignore Case)",
 "time_to_live": "730 days",
 "timeout_type": "LAST_SEEN",
 "create": "POST /api/reference_data/sets?name=Skopnix%3A%20Tortoiseshell%20-%20file%20hashs&element_type=ALNIC&time_to_live=730%20days&timeout_type=LAST_SEEN",
 "load": "POST /api/reference_data/sets/bulk_load/Skopnix%3A%20Tortoiseshell%20-%20file%20hashs  (body: JSON array of the elements)",
 "feed": "skopnix publishes this set as a feed; load it via the QRadar Reference Data API on a schedule (or Admin > Reference Set Management > Import). Elements age out on the time-to-live, so a retired skopnix indicator stops matching without a manual purge.",
 "elements": [
  "02a3296238a3d127a2e517f4949d31914c15d96726fb4902322c065153b364b2",
  "07d123364d8d04e3fe0bfa4e0e23ddc7050ef039602ecd72baed70e6553c3ae4",
  "d9ac9c950e5495c9005b04843a40f01fa49d5fd49226cb5b03a055232ffc36f3",
  "f71732f997c53fa45eef5c988697eb4aa62c8655d8f0be3268636fc23addd193"
 ]
}

4 elements · one per line for a bulk import ↓

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References