Operation XENOFISCAL - XenoRAT C2 185.235.x subnet connection

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule detects network connections to the 185.235.137.0/24 subnet, which is associated with XenoRAT command and control (C2) infrastructure. The detection specifically looks for these connections being initiated by 'mshta.exe' or 'powershell.exe', indicating potential malware activity or C2 communication.