BeepRAT C2 - Rapid DNS Enumeration + Non-Standard TCP from AppData/Temp

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects suspicious network traffic potentially associated with BeePRAT malware, identified by specific process image paths in temporary or TCC-related directories, connections to known malicious C2 IP addresses/ports, or non-standard TCP communication patterns involving suspicious domain queries.