RondoDox/TerraBot/r00ts3c Botnet User-Agent and IoT Scan Detection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

This rule monitors network device telemetry for three distinct indicators of compromise: usage of specific botnet-associated User-Agent strings, high-volume automated scanning against known IoT-vulnerable ports (80, 8080, 7547, 52869, 37215), and outbound network connections to known RondoDox command and control server infrastructure.