TinyRCT C2 Beaconing by PerfWatson2.exe to 45.32.113.172 via HTTP

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects network communication behavior consistent with the TinyRCT backdoor. The rule identifies instances where a process named 'PerfWatson2.exe' attempts to establish HTTP GET or POST connections to a known malicious IP address (45.32.113.172), signaling potential C2 beaconing activity using an encrypted channel.