XWorm RAT Network Connection

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•6

This rule detects network connections to remote URLs containing indicators associated with the XWorm Remote Access Trojan (RAT). It specifically looks for 'xworm', 'x-worm', 'wormx', or '/xworm' within the RemoteUrl field of DeviceNetworkEvents.