Turla Cereal Exchange hunt kit (Cybersecsloth, 2026-11-10). LAB-ONLY / DEFENSIVE USE.
1. On the Exchange server (admin, read-only): collect-cereal.ps1  -> .\cereal-collect
2. On Kali: cereal-hunt.py urlacl|iis|hashes|agents <artifact>
Indicators: ESET WeLiveSecurity + white paper + github.com/eset/malware-ioc (turla), 2026-11-10.
No exploit code, no network activity. A clean run covers known IoCs only.
