C2 Port Hopping - Multiple Non-Standard Ports

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This Suricata rule detects C2 port hopping behavior by identifying a single source IP initiating 10 or more TCP SYN packets to different non-standard ports within a 30-second window. This pattern is indicative of command and control (C2) communication attempting to evade detection by frequently changing ports.